Marcus Updateinfo to OVAL Converter 5.5 2026-04-14T04:45:16 SUSE Liberty Linux 7 The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address. Important CVE-2004-2771 at SUSE CVE-2004-2771 at NVD SUSE bug 909208 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file. Moderate CVE-2005-1080 at SUSE CVE-2005-1080 at NVD SUSE bug 191845 SUSE bug 607043 SUSE bug 607762 SUSE bug 818591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment. Low CVE-2010-5298 at SUSE CVE-2010-5298 at NVD SUSE bug 873351 SUSE bug 880891 SUSE bug 883126 SUSE bug 885777 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. Moderate CVE-2010-5312 at SUSE CVE-2010-5312 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842. Moderate CVE-2010-5313 at SUSE CVE-2010-5313 at NVD SUSE bug 905312 SUSE bug 907822 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users) Important CVE-2011-10007 at SUSE CVE-2011-10007 at NVD SUSE bug 1244148 SUSE Liberty Linux 7 xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generated image. Moderate CVE-2012-2150 at SUSE CVE-2012-2150 at NVD SUSE bug 939367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo. Moderate CVE-2012-6662 at SUSE CVE-2012-6662 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. Moderate CVE-2013-0334 at SUSE CVE-2013-0334 at NVD SUSE bug 898205 SUSE bug 922719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions Moderate CVE-2013-1752 at SUSE CVE-2013-1752 at NVD SUSE bug 856835 SUSE bug 856836 SUSE bug 863741 SUSE bug 885882 SUSE bug 898572 SUSE bug 912739 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request. Moderate CVE-2013-1753 at SUSE CVE-2013-1753 at NVD SUSE bug 856835 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions. Low CVE-2013-2139 at SUSE CVE-2013-2139 at NVD SUSE bug 828009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h. Moderate CVE-2013-2929 at SUSE CVE-2013-2929 at NVD SUSE bug 824295 SUSE bug 847652 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names. Moderate CVE-2013-4002 at SUSE CVE-2013-4002 at NVD SUSE bug 829212 SUSE bug 846177 SUSE bug 846999 SUSE bug 849212 SUSE bug 852367 SUSE bug 977650 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow. Moderate CVE-2013-4148 at SUSE CVE-2013-4148 at NVD SUSE bug 864812 SUSE bug 871442 SUSE bug 964630 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table. Moderate CVE-2013-4149 at SUSE CVE-2013-4149 at NVD SUSE bug 864649 SUSE bug 871442 SUSE bug 964443 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write. Moderate CVE-2013-4150 at SUSE CVE-2013-4150 at NVD SUSE bug 864650 SUSE bug 871442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write. Moderate CVE-2013-4151 at SUSE CVE-2013-4151 at NVD SUSE bug 864653 SUSE bug 871442 SUSE bug 964636 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. Moderate CVE-2013-4286 at SUSE CVE-2013-4286 at NVD SUSE bug 865740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. Moderate CVE-2013-4312 at SUSE CVE-2013-4312 at NVD SUSE bug 1020452 SUSE bug 839104 SUSE bug 922947 SUSE bug 968014 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. Moderate CVE-2013-4322 at SUSE CVE-2013-4322 at NVD SUSE bug 865746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value. Moderate CVE-2013-4352 at SUSE CVE-2013-4352 at NVD SUSE bug 887771 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers. Moderate CVE-2013-4527 at SUSE CVE-2013-4527 at NVD SUSE bug 864673 SUSE bug 871442 SUSE bug 964746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image. Moderate CVE-2013-4529 at SUSE CVE-2013-4529 at NVD SUSE bug 864678 SUSE bug 871442 SUSE bug 964929 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read. Moderate CVE-2013-4535 at SUSE CVE-2013-4535 at NVD SUSE bug 864665 SUSE bug 964676 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. Moderate CVE-2013-4536 at SUSE CVE-2013-4536 at NVD SUSE bug 864665 SUSE bug 871442 SUSE bug 964676 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value. Moderate CVE-2013-4541 at SUSE CVE-2013-4541 at NVD SUSE bug 864802 SUSE bug 871442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds array access. Moderate CVE-2013-4542 at SUSE CVE-2013-4542 at NVD SUSE bug 864804 SUSE bug 871442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file. Important CVE-2013-5653 at SUSE CVE-2013-5653 at NVD SUSE bug 1001951 SUSE bug 1004237 SUSE bug 1007816 SUSE bug 1036453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such." Low CVE-2013-5704 at SUSE CVE-2013-5704 at NVD SUSE bug 871310 SUSE bug 914535 SUSE bug 930944 SUSE bug 938728 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors. Moderate CVE-2013-6370 at SUSE CVE-2013-6370 at NVD SUSE bug 870147 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions. Moderate CVE-2013-6371 at SUSE CVE-2013-6371 at NVD SUSE bug 870147 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image. Moderate CVE-2013-6399 at SUSE CVE-2013-6399 at NVD SUSE bug 864814 SUSE bug 871442 SUSE bug 964643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory. Important CVE-2013-6435 at SUSE CVE-2013-6435 at NVD SUSE bug 1101137 SUSE bug 1127299 SUSE bug 906803 SUSE bug 908128 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters. Moderate CVE-2013-7345 at SUSE CVE-2013-7345 at NVD SUSE bug 869906 SUSE bug 883306 SUSE bug 987530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644. Low CVE-2013-7421 at SUSE CVE-2013-7421 at NVD SUSE bug 914423 SUSE bug 914660 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function. Moderate CVE-2013-7423 at SUSE CVE-2013-7423 at NVD SUSE bug 1123874 SUSE bug 915526 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data. Moderate CVE-2014-0075 at SUSE CVE-2014-0075 at NVD SUSE bug 887557 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Moderate CVE-2014-0096 at SUSE CVE-2014-0096 at NVD SUSE bug 865746 SUSE bug 880346 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. Moderate CVE-2014-0099 at SUSE CVE-2014-0099 at NVD SUSE bug 865746 SUSE bug 880347 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header. Moderate CVE-2014-0117 at SUSE CVE-2014-0117 at NVD SUSE bug 887767 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size. Moderate CVE-2014-0118 at SUSE CVE-2014-0118 at NVD SUSE bug 1078450 SUSE bug 887769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. Low CVE-2014-0119 at SUSE CVE-2014-0119 at NVD SUSE bug 865746 SUSE bug 880348 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request. Low CVE-2014-0178 at SUSE CVE-2014-0178 at NVD SUSE bug 872396 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods. Low CVE-2014-0179 at SUSE CVE-2014-0179 at NVD SUSE bug 873705 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. Moderate CVE-2014-0181 at SUSE CVE-2014-0181 at NVD SUSE bug 875051 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image. Moderate CVE-2014-0182 at SUSE CVE-2014-0182 at NVD SUSE bug 874788 SUSE bug 964693 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request. NOTE: this vulnerability exists because of an unspecified regression. Moderate CVE-2014-0186 at SUSE CVE-2014-0186 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document. Important CVE-2014-0191 at SUSE CVE-2014-0191 at NVD SUSE bug 1014873 SUSE bug 1123919 SUSE bug 876652 SUSE bug 877506 SUSE bug 996079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment. Moderate CVE-2014-0195 at SUSE CVE-2014-0195 at NVD SUSE bug 880891 SUSE bug 885777 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. Moderate CVE-2014-0196 at SUSE CVE-2014-0196 at NVD SUSE bug 871252 SUSE bug 875690 SUSE bug 877345 SUSE bug 879878 SUSE bug 933423 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition. Moderate CVE-2014-0198 at SUSE CVE-2014-0198 at NVD SUSE bug 876282 SUSE bug 880891 SUSE bug 885777 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value. Low CVE-2014-0206 at SUSE CVE-2014-0206 at NVD SUSE bug 884324 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file. Moderate CVE-2014-0207 at SUSE CVE-2014-0207 at NVD SUSE bug 884986 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata. Moderate CVE-2014-0209 at SUSE CVE-2014-0209 at NVD SUSE bug 857544 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function. Important CVE-2014-0210 at SUSE CVE-2014-0210 at NVD SUSE bug 857544 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Important CVE-2014-0211 at SUSE CVE-2014-0211 at NVD SUSE bug 857544 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake. Moderate CVE-2014-0221 at SUSE CVE-2014-0221 at NVD SUSE bug 880891 SUSE bug 883126 SUSE bug 885777 SUSE bug 905106 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image. Moderate CVE-2014-0222 at SUSE CVE-2014-0222 at NVD SUSE bug 1072223 SUSE bug 877642 SUSE bug 950367 SUSE bug 964925 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read. Moderate CVE-2014-0223 at SUSE CVE-2014-0223 at NVD SUSE bug 877645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability. Important CVE-2014-0224 at SUSE CVE-2014-0224 at NVD SUSE bug 1146657 SUSE bug 880891 SUSE bug 881743 SUSE bug 883126 SUSE bug 885777 SUSE bug 892403 SUSE bug 901237 SUSE bug 903703 SUSE bug 905018 SUSE bug 905106 SUSE bug 914447 SUSE bug 915913 SUSE bug 916239 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. Moderate CVE-2014-0226 at SUSE CVE-2014-0226 at NVD SUSE bug 887765 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. Moderate CVE-2014-0227 at SUSE CVE-2014-0227 at NVD SUSE bug 917127 SUSE bug 926762 SUSE bug 988489 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor. Moderate CVE-2014-0231 at SUSE CVE-2014-0231 at NVD SUSE bug 887768 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls. Moderate CVE-2014-0237 at SUSE CVE-2014-0237 at NVD SUSE bug 880905 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long. Moderate CVE-2014-0238 at SUSE CVE-2014-0238 at NVD SUSE bug 880904 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes. Important CVE-2014-0240 at SUSE CVE-2014-0240 at NVD SUSE bug 878550 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet. Low CVE-2014-0244 at SUSE CVE-2014-0244 at NVD SUSE bug 880962 SUSE bug 883758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML. Low CVE-2014-0384 at SUSE CVE-2014-0384 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Critical CVE-2014-0429 at SUSE CVE-2014-0429 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Critical CVE-2014-0446 at SUSE CVE-2014-0446 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412. Critical CVE-2014-0451 at SUSE CVE-2014-0451 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0458 and CVE-2014-2423. Critical CVE-2014-0452 at SUSE CVE-2014-0452 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security. Critical CVE-2014-0453 at SUSE CVE-2014-0453 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. Critical CVE-2014-0454 at SUSE CVE-2014-0454 at NVD SUSE bug 873873 SUSE bug 877429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402. Critical CVE-2014-0455 at SUSE CVE-2014-0455 at NVD SUSE bug 873873 SUSE bug 877429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Critical CVE-2014-0456 at SUSE CVE-2014-0456 at NVD SUSE bug 873872 SUSE bug 873873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Critical CVE-2014-0457 at SUSE CVE-2014-0457 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423. Critical CVE-2014-0458 at SUSE CVE-2014-0458 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D. Critical CVE-2014-0459 at SUSE CVE-2014-0459 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI. Critical CVE-2014-0460 at SUSE CVE-2014-0460 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Critical CVE-2014-0461 at SUSE CVE-2014-0461 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable. Moderate CVE-2014-0475 at SUSE CVE-2014-0475 at NVD SUSE bug 887022 SUSE bug 896776 SUSE bug 916222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax. Moderate CVE-2014-10071 at SUSE CVE-2014-10071 at NVD SUSE bug 1082977 SUSE bug 1200039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links. Moderate CVE-2014-10072 at SUSE CVE-2014-10072 at NVD SUSE bug 1082975 SUSE bug 1200039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. Moderate CVE-2014-1492 at SUSE CVE-2014-1492 at NVD SUSE bug 869827 SUSE bug 926974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue. Moderate CVE-2014-1568 at SUSE CVE-2014-1568 at NVD SUSE bug 1107874 SUSE bug 897890 SUSE bug 898959 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2014-1574 at SUSE CVE-2014-1574 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style. Moderate CVE-2014-1576 at SUSE CVE-2014-1576 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value. Moderate CVE-2014-1577 at SUSE CVE-2014-1577 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback. Moderate CVE-2014-1578 at SUSE CVE-2014-1578 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. Moderate CVE-2014-1581 at SUSE CVE-2014-1581 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm. Moderate CVE-2014-1583 at SUSE CVE-2014-1583 at NVD SUSE bug 900941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2014-1587 at SUSE CVE-2014-1587 at NVD SUSE bug 908009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object. Moderate CVE-2014-1590 at SUSE CVE-2014-1590 at NVD SUSE bug 908009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing. Moderate CVE-2014-1592 at SUSE CVE-2014-1592 at NVD SUSE bug 908009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content. Moderate CVE-2014-1593 at SUSE CVE-2014-1593 at NVD SUSE bug 908009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type. Moderate CVE-2014-1594 at SUSE CVE-2014-1594 at NVD SUSE bug 908009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. Moderate CVE-2014-1737 at SUSE CVE-2014-1737 at NVD SUSE bug 1115893 SUSE bug 875798 SUSE bug 877345 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. Moderate CVE-2014-1738 at SUSE CVE-2014-1738 at NVD SUSE bug 875798 SUSE bug 877345 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call. Moderate CVE-2014-1739 at SUSE CVE-2014-1739 at NVD SUSE bug 882804 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log. Moderate CVE-2014-1876 at SUSE CVE-2014-1876 at NVD SUSE bug 863305 SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Critical CVE-2014-2397 at SUSE CVE-2014-2397 at NVD SUSE bug 873872 SUSE bug 873873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc. Low CVE-2014-2398 at SUSE CVE-2014-2398 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455. Critical CVE-2014-2402 at SUSE CVE-2014-2402 at NVD SUSE bug 873873 SUSE bug 877429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP. Critical CVE-2014-2403 at SUSE CVE-2014-2403 at NVD SUSE bug 873872 SUSE bug 873873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451. Critical CVE-2014-2412 at SUSE CVE-2014-2412 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries. Critical CVE-2014-2413 at SUSE CVE-2014-2413 at NVD SUSE bug 873873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB. Critical CVE-2014-2414 at SUSE CVE-2014-2414 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition. Critical CVE-2014-2419 at SUSE CVE-2014-2419 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Critical CVE-2014-2421 at SUSE CVE-2014-2421 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458. Critical CVE-2014-2423 at SUSE CVE-2014-2423 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound. Critical CVE-2014-2427 at SUSE CVE-2014-2427 at NVD SUSE bug 873872 SUSE bug 873873 SUSE bug 877429 SUSE bug 877430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema. Low CVE-2014-2430 at SUSE CVE-2014-2430 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect availability via unknown vectors related to Options. Moderate CVE-2014-2431 at SUSE CVE-2014-2431 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability Oracle the MySQL Server component 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Federated. Critical CVE-2014-2432 at SUSE CVE-2014-2432 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR. Critical CVE-2014-2436 at SUSE CVE-2014-2436 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication. Low CVE-2014-2438 at SUSE CVE-2014-2438 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Moderate CVE-2014-2440 at SUSE CVE-2014-2440 at NVD SUSE bug 873896 SUSE bug 999706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC. Moderate CVE-2014-2494 at SUSE CVE-2014-2494 at NVD SUSE bug 887580 SUSE bug 915914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. Moderate CVE-2014-2497 at SUSE CVE-2014-2497 at NVD SUSE bug 868624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced. Low CVE-2014-2568 at SUSE CVE-2014-2568 at NVD SUSE bug 869564 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. Moderate CVE-2014-2653 at SUSE CVE-2014-2653 at NVD SUSE bug 1074631 SUSE bug 870532 SUSE bug 913479 SUSE bug 916239 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions. Moderate CVE-2014-2672 at SUSE CVE-2014-2672 at NVD SUSE bug 871148 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state. Moderate CVE-2014-2673 at SUSE CVE-2014-2673 at NVD SUSE bug 871149 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. Moderate CVE-2014-2706 at SUSE CVE-2014-2706 at NVD SUSE bug 1115893 SUSE bug 871797 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. Moderate CVE-2014-2851 at SUSE CVE-2014-2851 at NVD SUSE bug 824295 SUSE bug 873374 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. Moderate CVE-2014-2894 at SUSE CVE-2014-2894 at NVD SUSE bug 874749 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. Moderate CVE-2014-3144 at SUSE CVE-2014-3144 at NVD SUSE bug 824295 SUSE bug 877257 SUSE bug 889071 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. Moderate CVE-2014-3145 at SUSE CVE-2014-3145 at NVD SUSE bug 824295 SUSE bug 877257 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. Important CVE-2014-3153 at SUSE CVE-2014-3153 at NVD SUSE bug 877775 SUSE bug 880892 SUSE bug 882228 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event. Moderate CVE-2014-3181 at SUSE CVE-2014-3181 at NVD SUSE bug 896382 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value. Moderate CVE-2014-3182 at SUSE CVE-2014-3182 at NVD SUSE bug 896385 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c. Moderate CVE-2014-3184 at SUSE CVE-2014-3184 at NVD SUSE bug 896390 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. Moderate CVE-2014-3185 at SUSE CVE-2014-3185 at NVD SUSE bug 896391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report. Moderate CVE-2014-3186 at SUSE CVE-2014-3186 at NVD SUSE bug 896392 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks." Moderate CVE-2014-3461 at SUSE CVE-2014-3461 at NVD SUSE bug 878541 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN. Moderate CVE-2014-3465 at SUSE CVE-2014-3465 at NVD SUSE bug 880733 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message. Moderate CVE-2014-3466 at SUSE CVE-2014-3466 at NVD SUSE bug 880730 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data. Moderate CVE-2014-3467 at SUSE CVE-2014-3467 at NVD SUSE bug 880737 SUSE bug 880910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data. Important CVE-2014-3468 at SUSE CVE-2014-3468 at NVD SUSE bug 880735 SUSE bug 880910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument. Moderate CVE-2014-3469 at SUSE CVE-2014-3469 at NVD SUSE bug 880738 SUSE bug 880910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value. Moderate CVE-2014-3470 at SUSE CVE-2014-3470 at NVD SUSE bug 880891 SUSE bug 883126 SUSE bug 885777 SUSE bug 905106 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion. Moderate CVE-2014-3478 at SUSE CVE-2014-3478 at NVD SUSE bug 884987 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file. Moderate CVE-2014-3479 at SUSE CVE-2014-3479 at NVD SUSE bug 884989 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. Moderate CVE-2014-3480 at SUSE CVE-2014-3480 at NVD SUSE bug 884990 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. Moderate CVE-2014-3487 at SUSE CVE-2014-3487 at NVD SUSE bug 884991 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818. Moderate CVE-2014-3490 at SUSE CVE-2014-3490 at NVD SUSE bug 1101653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference. Low CVE-2014-3493 at SUSE CVE-2014-3493 at NVD SUSE bug 878642 SUSE bug 880962 SUSE bug 883758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors. Moderate CVE-2014-3499 at SUSE CVE-2014-3499 at NVD SUSE bug 885209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message. Moderate CVE-2014-3513 at SUSE CVE-2014-3513 at NVD SUSE bug 901277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage. Moderate CVE-2014-3515 at SUSE CVE-2014-3515 at NVD SUSE bug 884992 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. Low CVE-2014-3528 at SUSE CVE-2014-3528 at NVD SUSE bug 889849 SUSE bug 890511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call. Important CVE-2014-3534 at SUSE CVE-2014-3534 at NVD SUSE bug 885460 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345. Moderate CVE-2014-3538 at SUSE CVE-2014-3538 at NVD SUSE bug 935225 SUSE bug 987530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h. Important CVE-2014-3560 at SUSE CVE-2014-3560 at NVD SUSE bug 889429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd crash) via a crafted SNMP trap message, which triggers a conversion to the variable type designated in the MIB file, as demonstrated by a NULL type in an ifMtu trap message. Moderate CVE-2014-3565 at SUSE CVE-2014-3565 at NVD SUSE bug 894361 SUSE bug 969779 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Critical CVE-2014-3566 at SUSE CVE-2014-3566 at NVD SUSE bug 1011293 SUSE bug 1031023 SUSE bug 901223 SUSE bug 901254 SUSE bug 901277 SUSE bug 901748 SUSE bug 901757 SUSE bug 901759 SUSE bug 901889 SUSE bug 901968 SUSE bug 902229 SUSE bug 902233 SUSE bug 902476 SUSE bug 903405 SUSE bug 903684 SUSE bug 904889 SUSE bug 905106 SUSE bug 914041 SUSE bug 994144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. Important CVE-2014-3567 at SUSE CVE-2014-3567 at NVD SUSE bug 877506 SUSE bug 901277 SUSE bug 905106 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c. Moderate CVE-2014-3570 at SUSE CVE-2014-3570 at NVD SUSE bug 912296 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 SUSE bug 944456 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c. Moderate CVE-2014-3571 at SUSE CVE-2014-3571 at NVD SUSE bug 912294 SUSE bug 915848 SUSE bug 927623 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message. Moderate CVE-2014-3572 at SUSE CVE-2014-3572 at NVD SUSE bug 912015 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field. Moderate CVE-2014-3577 at SUSE CVE-2014-3577 at NVD SUSE bug 1178171 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist. Moderate CVE-2014-3580 at SUSE CVE-2014-3580 at NVD SUSE bug 909935 SUSE bug 910376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header. Moderate CVE-2014-3581 at SUSE CVE-2014-3581 at NVD SUSE bug 899836 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571. Moderate CVE-2014-3587 at SUSE CVE-2014-3587 at NVD SUSE bug 987530 SUSE bug 992991 SUSE bug 998845 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049. Moderate CVE-2014-3597 at SUSE CVE-2014-3597 at NVD SUSE bug 893853 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." Moderate CVE-2014-3609 at SUSE CVE-2014-3609 at NVD SUSE bug 893649 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. Important CVE-2014-3611 at SUSE CVE-2014-3611 at NVD SUSE bug 899192 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1. Moderate CVE-2014-3613 at SUSE CVE-2014-3613 at NVD SUSE bug 894575 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution. Moderate CVE-2014-3615 at SUSE CVE-2014-3615 at NVD SUSE bug 895528 SUSE bug 918998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes." Important CVE-2014-3618 at SUSE CVE-2014-3618 at NVD SUSE bug 1068648 SUSE bug 894999 SUSE bug 898303 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation. Important CVE-2014-3631 at SUSE CVE-2014-3631 at NVD SUSE bug 896262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read. Moderate CVE-2014-3633 at SUSE CVE-2014-3633 at NVD SUSE bug 897783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access. Important CVE-2014-3634 at SUSE CVE-2014-3634 at NVD SUSE bug 897262 SUSE bug 899756 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket. CVE-2014-3640 at SUSE CVE-2014-3640 at NVD SUSE bug 897654 SUSE bug 965112 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Important CVE-2014-3645 at SUSE CVE-2014-3645 at NVD SUSE bug 899192 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Moderate CVE-2014-3646 at SUSE CVE-2014-3646 at NVD SUSE bug 899192 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. Moderate CVE-2014-3647 at SUSE CVE-2014-3647 at NVD SUSE bug 1013038 SUSE bug 1134834 SUSE bug 899192 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command. Moderate CVE-2014-3657 at SUSE CVE-2014-3657 at NVD SUSE bug 897783 SUSE bug 899484 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack. Moderate CVE-2014-3660 at SUSE CVE-2014-3660 at NVD SUSE bug 1123919 SUSE bug 901546 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to an out-of-bounds read operation. Moderate CVE-2014-3668 at SUSE CVE-2014-3668 at NVD SUSE bug 902368 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value. Moderate CVE-2014-3669 at SUSE CVE-2014-3669 at NVD SUSE bug 902360 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function. Moderate CVE-2014-3670 at SUSE CVE-2014-3670 at NVD SUSE bug 902357 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. Important CVE-2014-3673 at SUSE CVE-2014-3673 at NVD SUSE bug 1115893 SUSE bug 902346 SUSE bug 902349 SUSE bug 904899 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame. Moderate CVE-2014-3686 at SUSE CVE-2014-3686 at NVD SUSE bug 1063667 SUSE bug 900611 SUSE bug 915323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. Important CVE-2014-3687 at SUSE CVE-2014-3687 at NVD SUSE bug 1115893 SUSE bug 902349 SUSE bug 904899 SUSE bug 909208 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c. Moderate CVE-2014-3688 at SUSE CVE-2014-3688 at NVD SUSE bug 902351 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU. Moderate CVE-2014-3690 at SUSE CVE-2014-3690 at NVD SUSE bug 902232 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Moderate CVE-2014-3694 at SUSE CVE-2014-3694 at NVD SUSE bug 902495 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response. Moderate CVE-2014-3695 at SUSE CVE-2014-3695 at NVD SUSE bug 902409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation. Moderate CVE-2014-3696 at SUSE CVE-2014-3696 at NVD SUSE bug 902410 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message. Moderate CVE-2014-3698 at SUSE CVE-2014-3698 at NVD SUSE bug 902408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information. Moderate CVE-2014-3707 at SUSE CVE-2014-3707 at NVD SUSE bug 901924 SUSE bug 951391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. Moderate CVE-2014-3710 at SUSE CVE-2014-3710 at NVD SUSE bug 902367 SUSE bug 910252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. Moderate CVE-2014-3917 at SUSE CVE-2014-3917 at NVD SUSE bug 880484 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c. Low CVE-2014-3940 at SUSE CVE-2014-3940 at NVD SUSE bug 881101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. Moderate CVE-2014-4027 at SUSE CVE-2014-4027 at NVD SUSE bug 882639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function. Moderate CVE-2014-4049 at SUSE CVE-2014-4049 at NVD SUSE bug 882992 SUSE bug 893853 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. Moderate CVE-2014-4171 at SUSE CVE-2014-4171 at NVD SUSE bug 883518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR. Moderate CVE-2014-4207 at SUSE CVE-2014-4207 at NVD SUSE bug 887580 SUSE bug 915914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED. Moderate CVE-2014-4243 at SUSE CVE-2014-4243 at NVD SUSE bug 887580 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC. Moderate CVE-2014-4258 at SUSE CVE-2014-4258 at NVD SUSE bug 887580 SUSE bug 915914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier, and 5.6.17 and earlier, allows remote authenticated users to affect integrity and availability via vectors related to SRCHAR. Moderate CVE-2014-4260 at SUSE CVE-2014-4260 at NVD SUSE bug 887580 SUSE bug 915914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to SERVER:MyISAM. Moderate CVE-2014-4274 at SUSE CVE-2014-4274 at NVD SUSE bug 857678 SUSE bug 896400 SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS. Moderate CVE-2014-4287 at SUSE CVE-2014-4287 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data. Important CVE-2014-4337 at SUSE CVE-2014-4337 at NVD SUSE bug 871327 SUSE bug 883543 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformed cups-browsed.conf BrowseAllow directive that is interpreted as granting browse access to all IP addresses. Low CVE-2014-4338 at SUSE CVE-2014-4338 at NVD SUSE bug 871327 SUSE bug 883536 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session. Moderate CVE-2014-4341 at SUSE CVE-2014-4341 at NVD SUSE bug 770172 SUSE bug 886016 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session. Moderate CVE-2014-4342 at SUSE CVE-2014-4342 at NVD SUSE bug 770172 SUSE bug 886016 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator. Important CVE-2014-4343 at SUSE CVE-2014-4343 at NVD SUSE bug 770172 SUSE bug 888697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation. Important CVE-2014-4344 at SUSE CVE-2014-4344 at NVD SUSE bug 888697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands. Moderate CVE-2014-4345 at SUSE CVE-2014-4345 at NVD SUSE bug 770172 SUSE bug 891082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function. Moderate CVE-2014-4616 at SUSE CVE-2014-4616 at NVD SUSE bug 884075 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. Moderate CVE-2014-4650 at SUSE CVE-2014-4650 at NVD SUSE bug 856835 SUSE bug 856836 SUSE bug 863741 SUSE bug 885882 SUSE bug 898572 SUSE bug 912739 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. Moderate CVE-2014-4652 at SUSE CVE-2014-4652 at NVD SUSE bug 883795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. Moderate CVE-2014-4653 at SUSE CVE-2014-4653 at NVD SUSE bug 883795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. Moderate CVE-2014-4654 at SUSE CVE-2014-4654 at NVD SUSE bug 883795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. Moderate CVE-2014-4655 at SUSE CVE-2014-4655 at NVD SUSE bug 883795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. Moderate CVE-2014-4656 at SUSE CVE-2014-4656 at NVD SUSE bug 883795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. Moderate CVE-2014-4667 at SUSE CVE-2014-4667 at NVD SUSE bug 885422 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments. Moderate CVE-2014-4670 at SUSE CVE-2014-4670 at NVD SUSE bug 886059 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments. Moderate CVE-2014-4698 at SUSE CVE-2014-4698 at NVD SUSE bug 886060 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. Moderate CVE-2014-4699 at SUSE CVE-2014-4699 at NVD SUSE bug 885725 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php. Moderate CVE-2014-4721 at SUSE CVE-2014-4721 at NVD SUSE bug 885961 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink. Important CVE-2014-4877 at SUSE CVE-2014-4877 at NVD SUSE bug 902709 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. Moderate CVE-2014-4943 at SUSE CVE-2014-4943 at NVD SUSE bug 887082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow. Moderate CVE-2014-4975 at SUSE CVE-2014-4975 at NVD SUSE bug 887877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions." Moderate CVE-2014-5033 at SUSE CVE-2014-5033 at NVD SUSE bug 836931 SUSE bug 864716 SUSE bug 912121 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program. Moderate CVE-2014-5045 at SUSE CVE-2014-5045 at NVD SUSE bug 889060 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. Moderate CVE-2014-5077 at SUSE CVE-2014-5077 at NVD SUSE bug 889173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules. Important CVE-2014-5119 at SUSE CVE-2014-5119 at NVD SUSE bug 892073 SUSE bug 903057 SUSE bug 916222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. Important CVE-2014-5120 at SUSE CVE-2014-5120 at NVD SUSE bug 1067090 SUSE bug 893855 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors. Low CVE-2014-5177 at SUSE CVE-2014-5177 at NVD SUSE bug 873705 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. Moderate CVE-2014-5352 at SUSE CVE-2014-5352 at NVD SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy. Low CVE-2014-5353 at SUSE CVE-2014-5353 at NVD SUSE bug 910457 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. Moderate CVE-2014-5355 at SUSE CVE-2014-5355 at NVD SUSE bug 770172 SUSE bug 918595 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. Moderate CVE-2014-5471 at SUSE CVE-2014-5471 at NVD SUSE bug 892490 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. Moderate CVE-2014-5472 at SUSE CVE-2014-5472 at NVD SUSE bug 892490 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8. Moderate CVE-2014-6040 at SUSE CVE-2014-6040 at NVD SUSE bug 894553 SUSE bug 903057 SUSE bug 916222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow. Important CVE-2014-6051 at SUSE CVE-2014-6051 at NVD SUSE bug 897031 SUSE bug 900896 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message. Important CVE-2014-6052 at SUSE CVE-2014-6052 at NVD SUSE bug 897031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc. Important CVE-2014-6053 at SUSE CVE-2014-6053 at NVD SUSE bug 897031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message. Important CVE-2014-6054 at SUSE CVE-2014-6054 at NVD SUSE bug 897031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message. Important CVE-2014-6055 at SUSE CVE-2014-6055 at NVD SUSE bug 897031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read. Moderate CVE-2014-6269 at SUSE CVE-2014-6269 at NVD SUSE bug 895849 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. Important CVE-2014-6271 at SUSE CVE-2014-6271 at NVD SUSE bug 1024628 SUSE bug 1130324 SUSE bug 870618 SUSE bug 896776 SUSE bug 898346 SUSE bug 898604 SUSE bug 898812 SUSE bug 898884 SUSE bug 900127 SUSE bug 900454 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode. Moderate CVE-2014-6410 at SUSE CVE-2014-6410 at NVD SUSE bug 896689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors. Moderate CVE-2014-6421 at SUSE CVE-2014-6421 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector. Moderate CVE-2014-6422 at SUSE CVE-2014-6422 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line. Moderate CVE-2014-6423 at SUSE CVE-2014-6423 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet. Moderate CVE-2014-6424 at SUSE CVE-2014-6424 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\0' character. Moderate CVE-2014-6425 at SUSE CVE-2014-6425 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Moderate CVE-2014-6426 at SUSE CVE-2014-6426 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position. Moderate CVE-2014-6427 at SUSE CVE-2014-6427 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2014-6428 at SUSE CVE-2014-6428 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Moderate CVE-2014-6429 at SUSE CVE-2014-6429 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Moderate CVE-2014-6430 at SUSE CVE-2014-6430 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers writes of uncompressed bytes beyond the end of the output buffer. Moderate CVE-2014-6431 at SUSE CVE-2014-6431 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Moderate CVE-2014-6432 at SUSE CVE-2014-6432 at NVD SUSE bug 897055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Critical CVE-2014-6457 at SUSE CVE-2014-6457 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML. Moderate CVE-2014-6463 at SUSE CVE-2014-6463 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB DML FOREIGN KEYS. Moderate CVE-2014-6464 at SUSE CVE-2014-6464 at NVD SUSE bug 901237 SUSE bug 915912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:OPTIMIZER. Moderate CVE-2014-6469 at SUSE CVE-2014-6469 at NVD SUSE bug 901237 SUSE bug 915912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:DML. Moderate CVE-2014-6484 at SUSE CVE-2014-6484 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries. Critical CVE-2014-6502 at SUSE CVE-2014-6502 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot. Critical CVE-2014-6504 at SUSE CVE-2014-6504 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to SERVER:MEMORY STORAGE ENGINE. Moderate CVE-2014-6505 at SUSE CVE-2014-6505 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Critical CVE-2014-6506 at SUSE CVE-2014-6506 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML. Moderate CVE-2014-6507 at SUSE CVE-2014-6507 at NVD SUSE bug 901237 SUSE bug 915912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Critical CVE-2014-6511 at SUSE CVE-2014-6511 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries. Critical CVE-2014-6512 at SUSE CVE-2014-6512 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP. Critical CVE-2014-6517 at SUSE CVE-2014-6517 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Hotspot. Critical CVE-2014-6519 at SUSE CVE-2014-6519 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL. Moderate CVE-2014-6520 at SUSE CVE-2014-6520 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to CLIENT:MYSQLDUMP. Moderate CVE-2014-6530 at SUSE CVE-2014-6530 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Critical CVE-2014-6531 at SUSE CVE-2014-6531 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN. Moderate CVE-2014-6551 at SUSE CVE-2014-6551 at NVD SUSE bug 901237 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML. Moderate CVE-2014-6555 at SUSE CVE-2014-6555 at NVD SUSE bug 901237 SUSE bug 915912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security. Critical CVE-2014-6558 at SUSE CVE-2014-6558 at NVD SUSE bug 901239 SUSE bug 901242 SUSE bug 901246 SUSE bug 904889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING. Moderate CVE-2014-6559 at SUSE CVE-2014-6559 at NVD SUSE bug 901237 SUSE bug 915912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML. Important CVE-2014-6568 at SUSE CVE-2014-6568 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591. Moderate CVE-2014-6585 at SUSE CVE-2014-6585 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Critical CVE-2014-6587 at SUSE CVE-2014-6587 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585. Critical CVE-2014-6591 at SUSE CVE-2014-6591 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Critical CVE-2014-6593 at SUSE CVE-2014-6593 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Critical CVE-2014-6601 at SUSE CVE-2014-6601 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals. Important CVE-2014-7145 at SUSE CVE-2014-7145 at NVD SUSE bug 897101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function. Moderate CVE-2014-7185 at SUSE CVE-2014-7185 at NVD SUSE bug 898572 SUSE bug 912739 SUSE bug 913479 SUSE bug 955182 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer. Moderate CVE-2014-7300 at SUSE CVE-2014-7300 at NVD SUSE bug 900031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. Moderate CVE-2014-7810 at SUSE CVE-2014-7810 at NVD SUSE bug 931442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value. Moderate CVE-2014-7815 at SUSE CVE-2014-7815 at NVD SUSE bug 902737 SUSE bug 962627 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))". Moderate CVE-2014-7817 at SUSE CVE-2014-7817 at NVD SUSE bug 906371 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem. Moderate CVE-2014-7822 at SUSE CVE-2014-7822 at NVD SUSE bug 1115893 SUSE bug 915322 SUSE bug 915517 SUSE bug 939240 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. Moderate CVE-2014-7823 at SUSE CVE-2014-7823 at NVD SUSE bug 904176 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. Important CVE-2014-7825 at SUSE CVE-2014-7825 at NVD SUSE bug 904012 SUSE bug 904013 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-7826 at SUSE CVE-2014-7826 at NVD SUSE bug 904012 SUSE bug 904013 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data. Moderate CVE-2014-7840 at SUSE CVE-2014-7840 at NVD SUSE bug 905097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk. Moderate CVE-2014-7841 at SUSE CVE-2014-7841 at NVD SUSE bug 904899 SUSE bug 905100 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313. Moderate CVE-2014-7842 at SUSE CVE-2014-7842 at NVD SUSE bug 905312 SUSE bug 907822 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. Important CVE-2014-7844 at SUSE CVE-2014-7844 at NVD SUSE bug 909208 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call. Moderate CVE-2014-7970 at SUSE CVE-2014-7970 at NVD SUSE bug 900644 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call. Moderate CVE-2014-7975 at SUSE CVE-2014-7975 at NVD SUSE bug 900392 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack. Moderate CVE-2014-8080 at SUSE CVE-2014-8080 at NVD SUSE bug 902851 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag. Moderate CVE-2014-8086 at SUSE CVE-2014-8086 at NVD SUSE bug 900881 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080. Moderate CVE-2014-8090 at SUSE CVE-2014-8090 at NVD SUSE bug 905326 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request. Moderate CVE-2014-8091 at SUSE CVE-2014-8091 at NVD SUSE bug 1000496 SUSE bug 882226 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in X.Org X Window System (aka X11 or X) X11R1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) ProcPutImage, (2) GetHosts, (3) RegionSizeof, or (4) REQUEST_FIXED_SIZE function, which triggers an out-of-bounds read or write. Moderate CVE-2014-8092 at SUSE CVE-2014-8092 at NVD SUSE bug 1000496 SUSE bug 1146596 SUSE bug 907268 SUSE bug 928520 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) __glXDisp_ReadPixels, (2) __glXDispSwap_ReadPixels, (3) __glXDisp_GetTexImage, (4) __glXDispSwap_GetTexImage, (5) GetSeparableFilter, (6) GetConvolutionFilter, (7) GetHistogram, (8) GetMinmax, (9) GetColorTable, (10) __glXGetAnswerBuffer, (11) __GLX_GET_ANSWER_BUFFER, (12) __glXMap1dReqSize, (13) __glXMap1fReqSize, (14) Map2Size, (15) __glXMap2dReqSize, (16) __glXMap2fReqSize, (17) __glXImageSize, or (18) __glXSeparableFilter2DReqSize function, which triggers an out-of-bounds read or write. Moderate CVE-2014-8093 at SUSE CVE-2014-8093 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write. Moderate CVE-2014-8094 at SUSE CVE-2014-8094 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function. Moderate CVE-2014-8095 at SUSE CVE-2014-8095 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SProcXCMiscGetXIDList function in the XC-MISC extension in X.Org X Window System (aka X11 or X) X11R6.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value. Moderate CVE-2014-8096 at SUSE CVE-2014-8096 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DBE extension in X.Org X Window System (aka X11 or X) X11R6.1 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcDbeSwapBuffers or (2) SProcDbeSwapBuffers function. Moderate CVE-2014-8097 at SUSE CVE-2014-8097 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) __glXDisp_Render, (2) __glXDisp_RenderLarge, (3) __glXDispSwap_VendorPrivate, (4) __glXDispSwap_VendorPrivateWithReply, (5) set_client_info, (6) __glXDispSwap_SetClientInfoARB, (7) DoSwapInterval, (8) DoGetProgramString, (9) DoGetString, (10) __glXDispSwap_RenderMode, (11) __glXDisp_GetCompressedTexImage, (12) __glXDispSwap_GetCompressedTexImage, (13) __glXDisp_FeedbackBuffer, (14) __glXDispSwap_FeedbackBuffer, (15) __glXDisp_SelectBuffer, (16) __glXDispSwap_SelectBuffer, (17) __glXDisp_Flush, (18) __glXDispSwap_Flush, (19) __glXDisp_Finish, (20) __glXDispSwap_Finish, (21) __glXDisp_ReadPixels, (22) __glXDispSwap_ReadPixels, (23) __glXDisp_GetTexImage, (24) __glXDispSwap_GetTexImage, (25) __glXDisp_GetPolygonStipple, (26) __glXDispSwap_GetPolygonStipple, (27) __glXDisp_GetSeparableFilter, (28) __glXDisp_GetSeparableFilterEXT, (29) __glXDisp_GetConvolutionFilter, (30) __glXDisp_GetConvolutionFilterEXT, (31) __glXDisp_GetHistogram, (32) __glXDisp_GetHistogramEXT, (33) __glXDisp_GetMinmax, (34) __glXDisp_GetMinmaxEXT, (35) __glXDisp_GetColorTable, (36) __glXDisp_GetColorTableSGI, (37) GetSeparableFilter, (38) GetConvolutionFilter, (39) GetHistogram, (40) GetMinmax, or (41) GetColorTable function. Moderate CVE-2014-8098 at SUSE CVE-2014-8098 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XVideo extension in XFree86 4.0.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXvQueryExtension, (2) SProcXvQueryAdaptors, (3) SProcXvQueryEncodings, (4) SProcXvGrabPort, (5) SProcXvUngrabPort, (6) SProcXvPutVideo, (7) SProcXvPutStill, (8) SProcXvGetVideo, (9) SProcXvGetStill, (10) SProcXvPutImage, (11) SProcXvShmPutImage, (12) SProcXvSelectVideoNotify, (13) SProcXvSelectPortNotify, (14) SProcXvStopVideo, (15) SProcXvSetPortAttribute, (16) SProcXvGetPortAttribute, (17) SProcXvQueryBestSize, (18) SProcXvQueryPortAttributes, (19) SProcXvQueryImageAttributes, or (20) SProcXvListImageFormats function. Moderate CVE-2014-8099 at SUSE CVE-2014-8099 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function. Moderate CVE-2014-8100 at SUSE CVE-2014-8100 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The RandR extension in XFree86 4.2.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcRRQueryVersion, (2) SProcRRGetScreenInfo, (3) SProcRRSelectInput, or (4) SProcRRConfigureOutputProperty function. Moderate CVE-2014-8101 at SUSE CVE-2014-8101 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value. Moderate CVE-2014-8102 at SUSE CVE-2014-8102 at NVD SUSE bug 1000496 SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) sproc_dri3_query_version, (2) sproc_dri3_open, (3) sproc_dri3_pixmap_from_buffer, (4) sproc_dri3_buffer_from_pixmap, (5) sproc_dri3_fence_from_fd, (6) sproc_dri3_fd_from_fence, (7) proc_present_query_capabilities, (8) sproc_present_query_version, (9) sproc_present_pixmap, (10) sproc_present_notify_msc, (11) sproc_present_select_input, or (12) sproc_present_query_capabilities function in the (a) DRI3 or (b) Present extension. Moderate CVE-2014-8103 at SUSE CVE-2014-8103 at NVD SUSE bug 907268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors. Moderate CVE-2014-8105 at SUSE CVE-2014-8105 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320. Moderate CVE-2014-8106 at SUSE CVE-2014-8106 at NVD SUSE bug 1023004 SUSE bug 1178658 SUSE bug 907805 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist. Moderate CVE-2014-8108 at SUSE CVE-2014-8108 at NVD SUSE bug 909935 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog. Low CVE-2014-8112 at SUSE CVE-2014-8112 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities. Moderate CVE-2014-8116 at SUSE CVE-2014-8116 at NVD SUSE bug 910252 SUSE bug 910253 SUSE bug 917152 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors. Moderate CVE-2014-8117 at SUSE CVE-2014-8117 at NVD SUSE bug 910252 SUSE bug 910253 SUSE bug 917152 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow. Critical CVE-2014-8118 at SUSE CVE-2014-8118 at NVD SUSE bug 1101137 SUSE bug 1127299 SUSE bug 906803 SUSE bug 908128 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions. Important CVE-2014-8119 at SUSE CVE-2014-8119 at NVD SUSE bug 925225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset. Moderate CVE-2014-8121 at SUSE CVE-2014-8121 at NVD SUSE bug 1123874 SUSE bug 918187 SUSE bug 945779 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool. Critical CVE-2014-8127 at SUSE CVE-2014-8127 at NVD SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c. Critical CVE-2014-8129 at SUSE CVE-2014-8129 at NVD SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither. Critical CVE-2014-8130 at SUSE CVE-2014-8130 at NVD SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 942690 SUSE bug 969783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors. Low CVE-2014-8136 at SUSE CVE-2014-8136 at NVD SUSE bug 910862 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file. Moderate CVE-2014-8137 at SUSE CVE-2014-8137 at NVD SUSE bug 1178702 SUSE bug 909474 SUSE bug 909475 SUSE bug 911837 SUSE bug 968373 SUSE bug 969776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file. Important CVE-2014-8138 at SUSE CVE-2014-8138 at NVD SUSE bug 1178702 SUSE bug 909474 SUSE bug 909475 SUSE bug 911837 SUSE bug 969776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command. Important CVE-2014-8139 at SUSE CVE-2014-8139 at NVD SUSE bug 909214 SUSE bug 915880 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command. Important CVE-2014-8140 at SUSE CVE-2014-8140 at NVD SUSE bug 909214 SUSE bug 914442 SUSE bug 915880 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command. Important CVE-2014-8141 at SUSE CVE-2014-8141 at NVD SUSE bug 909214 SUSE bug 915880 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019. Low CVE-2014-8142 at SUSE CVE-2014-8142 at NVD SUSE bug 910659 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL. Moderate CVE-2014-8150 at SUSE CVE-2014-8150 at NVD SUSE bug 911363 SUSE bug 951391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. Important CVE-2014-8157 at SUSE CVE-2014-8157 at NVD SUSE bug 1178702 SUSE bug 911837 SUSE bug 969776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. Important CVE-2014-8158 at SUSE CVE-2014-8158 at NVD SUSE bug 1178702 SUSE bug 911837 SUSE bug 969776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. Moderate CVE-2014-8159 at SUSE CVE-2014-8159 at NVD SUSE bug 903967 SUSE bug 914742 SUSE bug 939241 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers. Important CVE-2014-8160 at SUSE CVE-2014-8160 at NVD SUSE bug 857643 SUSE bug 913059 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message. Moderate CVE-2014-8161 at SUSE CVE-2014-8161 at NVD SUSE bug 916953 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory. Moderate CVE-2014-8169 at SUSE CVE-2014-8169 at NVD SUSE bug 917977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup. Moderate CVE-2014-8171 at SUSE CVE-2014-8171 at NVD SUSE bug 928128 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations. Moderate CVE-2014-8172 at SUSE CVE-2014-8172 at NVD SUSE bug 920632 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted MADV_WILLNEED madvise system call that leverages the absence of a page-table lock. Important CVE-2014-8173 at SUSE CVE-2014-8173 at NVD SUSE bug 920583 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data. Important CVE-2014-8176 at SUSE CVE-2014-8176 at NVD SUSE bug 1148697 SUSE bug 934494 SUSE bug 934666 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened. Important CVE-2014-8184 at SUSE CVE-2014-8184 at NVD SUSE bug 1056088 SUSE bug 1056090 SUSE bug 1056093 SUSE bug 1056095 SUSE bug 1056105 SUSE bug 1062458 SUSE bug 1067336 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051. Important CVE-2014-8240 at SUSE CVE-2014-8240 at NVD SUSE bug 900896 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052. Critical CVE-2014-8241 at SUSE CVE-2014-8241 at NVD SUSE bug 900898 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c. Moderate CVE-2014-8275 at SUSE CVE-2014-8275 at NVD SUSE bug 912018 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record. Moderate CVE-2014-8484 at SUSE CVE-2014-8484 at NVD SUSE bug 902676 SUSE bug 902677 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file. Moderate CVE-2014-8485 at SUSE CVE-2014-8485 at NVD SUSE bug 902676 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. Important CVE-2014-8500 at SUSE CVE-2014-8500 at NVD SUSE bug 908994 SUSE bug 986950 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable. Moderate CVE-2014-8501 at SUSE CVE-2014-8501 at NVD SUSE bug 903655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file. Moderate CVE-2014-8502 at SUSE CVE-2014-8502 at NVD SUSE bug 903655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file. Moderate CVE-2014-8503 at SUSE CVE-2014-8503 at NVD SUSE bug 903655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file. Moderate CVE-2014-8504 at SUSE CVE-2014-8504 at NVD SUSE bug 903655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application. Moderate CVE-2014-8559 at SUSE CVE-2014-8559 at NVD SUSE bug 903640 SUSE bug 915517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs. Moderate CVE-2014-8564 at SUSE CVE-2014-8564 at NVD SUSE bug 904603 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals. Moderate CVE-2014-8602 at SUSE CVE-2014-8602 at NVD SUSE bug 908990 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2014-8634 at SUSE CVE-2014-8634 at NVD SUSE bug 910669 SUSE bug 913064 SUSE bug 913096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site. Moderate CVE-2014-8638 at SUSE CVE-2014-8638 at NVD SUSE bug 910669 SUSE bug 913068 SUSE bug 913096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server. Moderate CVE-2014-8639 at SUSE CVE-2014-8639 at NVD SUSE bug 910669 SUSE bug 913066 SUSE bug 913096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data. Moderate CVE-2014-8641 at SUSE CVE-2014-8641 at NVD SUSE bug 910669 SUSE bug 913067 SUSE bug 913096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets. Important CVE-2014-8709 at SUSE CVE-2014-8709 at NVD SUSE bug 904700 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet. Moderate CVE-2014-8710 at SUSE CVE-2014-8710 at NVD SUSE bug 905246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet. Moderate CVE-2014-8711 at SUSE CVE-2014-8711 at NVD SUSE bug 905245 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2014-8712 at SUSE CVE-2014-8712 at NVD SUSE bug 905248 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2014-8713 at SUSE CVE-2014-8713 at NVD SUSE bug 905248 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Moderate CVE-2014-8714 at SUSE CVE-2014-8714 at NVD SUSE bug 905247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar. Moderate CVE-2014-8737 at SUSE CVE-2014-8737 at NVD SUSE bug 905736 SUSE bug 912408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive. Moderate CVE-2014-8738 at SUSE CVE-2014-8738 at NVD SUSE bug 905735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call. Moderate CVE-2014-8884 at SUSE CVE-2014-8884 at NVD SUSE bug 904876 SUSE bug 905522 SUSE bug 905739 SUSE bug 905744 SUSE bug 905748 SUSE bug 905764 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file. Important CVE-2014-8962 at SUSE CVE-2014-8962 at NVD SUSE bug 906831 SUSE bug 907764 SUSE bug 969774 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats. Moderate CVE-2014-8964 at SUSE CVE-2014-8964 at NVD SUSE bug 906574 SUSE bug 924960 SUSE bug 933288 SUSE bug 936408 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file. Important CVE-2014-9028 at SUSE CVE-2014-9028 at NVD SUSE bug 907016 SUSE bug 969774 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow. Important CVE-2014-9029 at SUSE CVE-2014-9029 at NVD SUSE bug 1178702 SUSE bug 906364 SUSE bug 909474 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. Moderate CVE-2014-9112 at SUSE CVE-2014-9112 at NVD SUSE bug 907456 SUSE bug 913479 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping. Moderate CVE-2014-9130 at SUSE CVE-2014-9130 at NVD SUSE bug 907809 SUSE bug 911782 SUSE bug 921588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write. Low CVE-2014-9273 at SUSE CVE-2014-9273 at NVD SUSE bug 908614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login. Low CVE-2014-9278 at SUSE CVE-2014-9278 at NVD SUSE bug 908424 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Important CVE-2014-9293 at SUSE CVE-2014-9293 at NVD SUSE bug 910764 SUSE bug 911053 SUSE bug 911792 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Important CVE-2014-9294 at SUSE CVE-2014-9294 at NVD SUSE bug 910764 SUSE bug 911053 SUSE bug 911792 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. Important CVE-2014-9295 at SUSE CVE-2014-9295 at NVD SUSE bug 910764 SUSE bug 911053 SUSE bug 911792 SUSE bug 916239 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. Important CVE-2014-9296 at SUSE CVE-2014-9296 at NVD SUSE bug 910764 SUSE bug 911053 SUSE bug 911792 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage Important CVE-2014-9297 at SUSE CVE-2014-9297 at NVD SUSE bug 911792 SUSE bug 948963 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in this candidate have been removed to prevent accidental usage Important CVE-2014-9298 at SUSE CVE-2014-9298 at NVD SUSE bug 911792 SUSE bug 948963 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space. Important CVE-2014-9322 at SUSE CVE-2014-9322 at NVD SUSE bug 1115893 SUSE bug 817142 SUSE bug 910251 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read. Moderate CVE-2014-9330 at SUSE CVE-2014-9330 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Moderate CVE-2014-9365 at SUSE CVE-2014-9365 at NVD SUSE bug 909713 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process. Important CVE-2014-9402 at SUSE CVE-2014-9402 at NVD SUSE bug 910599 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. Low CVE-2014-9419 at SUSE CVE-2014-9419 at NVD SUSE bug 911326 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. Moderate CVE-2014-9420 at SUSE CVE-2014-9420 at NVD SUSE bug 906545 SUSE bug 911325 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. Moderate CVE-2014-9421 at SUSE CVE-2014-9421 at NVD SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. Moderate CVE-2014-9422 at SUSE CVE-2014-9422 at NVD SUSE bug 1005509 SUSE bug 770172 SUSE bug 912002 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. Moderate CVE-2014-9423 at SUSE CVE-2014-9423 at NVD SUSE bug 1005509 SUSE bug 912002 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str. Low CVE-2014-9474 at SUSE CVE-2014-9474 at NVD SUSE bug 911812 SUSE Liberty Linux 7 Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. Moderate CVE-2014-9529 at SUSE CVE-2014-9529 at NVD SUSE bug 1072204 SUSE bug 1115893 SUSE bug 912202 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image. Moderate CVE-2014-9584 at SUSE CVE-2014-9584 at NVD SUSE bug 912654 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. Important CVE-2014-9585 at SUSE CVE-2014-9585 at NVD SUSE bug 912705 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression. Important CVE-2014-9636 at SUSE CVE-2014-9636 at NVD SUSE bug 914442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421. CVE-2014-9644 at SUSE CVE-2014-9644 at NVD SUSE bug 914423 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file. Important CVE-2014-9652 at SUSE CVE-2014-9652 at NVD SUSE bug 917150 SUSE bug 917302 SUSE bug 918768 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file. Important CVE-2014-9653 at SUSE CVE-2014-9653 at NVD SUSE bug 917152 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif. Moderate CVE-2014-9655 at SUSE CVE-2014-9655 at NVD SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 SUSE bug 916927 SUSE bug 969783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. Moderate CVE-2014-9657 at SUSE CVE-2014-9657 at NVD SUSE bug 916856 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. Moderate CVE-2014-9658 at SUSE CVE-2014-9658 at NVD SUSE bug 916857 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font. Moderate CVE-2014-9660 at SUSE CVE-2014-9660 at NVD SUSE bug 916858 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font. Moderate CVE-2014-9661 at SUSE CVE-2014-9661 at NVD SUSE bug 916859 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table. Moderate CVE-2014-9663 at SUSE CVE-2014-9663 at NVD SUSE bug 916865 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c. Moderate CVE-2014-9664 at SUSE CVE-2014-9664 at NVD SUSE bug 916864 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table. Moderate CVE-2014-9667 at SUSE CVE-2014-9667 at NVD SUSE bug 916861 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table. Moderate CVE-2014-9669 at SUSE CVE-2014-9669 at NVD SUSE bug 916870 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row. Moderate CVE-2014-9670 at SUSE CVE-2014-9670 at NVD SUSE bug 916871 SUSE bug 933247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented. Moderate CVE-2014-9671 at SUSE CVE-2014-9671 at NVD SUSE bug 916872 SUSE bug 933247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. Moderate CVE-2014-9673 at SUSE CVE-2014-9673 at NVD SUSE bug 916874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. Moderate CVE-2014-9674 at SUSE CVE-2014-9674 at NVD SUSE bug 916879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font. Moderate CVE-2014-9675 at SUSE CVE-2014-9675 at NVD SUSE bug 916881 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow. Important CVE-2014-9679 at SUSE CVE-2014-9679 at NVD SUSE bug 917799 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries. Moderate CVE-2014-9705 at SUSE CVE-2014-9705 at NVD SUSE bug 922451 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function. Low CVE-2014-9709 at SUSE CVE-2014-9709 at NVD SUSE bug 923945 SUSE bug 923946 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment. Moderate CVE-2014-9715 at SUSE CVE-2014-9715 at NVD SUSE bug 927780 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field. Important CVE-2014-9750 at SUSE CVE-2014-9750 at NVD SUSE bug 911792 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address. Important CVE-2014-9751 at SUSE CVE-2014-9751 at NVD SUSE bug 911792 SUSE bug 948963 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function. Critical CVE-2014-9761 at SUSE CVE-2014-9761 at NVD SUSE bug 1123874 SUSE bug 962738 SUSE bug 986086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution. Moderate CVE-2014-9938 at SUSE CVE-2014-9938 at NVD SUSE bug 1030059 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations. Critical CVE-2015-0204 at SUSE CVE-2015-0204 at NVD SUSE bug 912014 SUSE bug 920482 SUSE bug 920484 SUSE bug 927591 SUSE bug 927623 SUSE bug 936787 SUSE bug 952088 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support. Moderate CVE-2015-0205 at SUSE CVE-2015-0205 at NVD SUSE bug 912293 SUSE bug 915848 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection. Moderate CVE-2015-0206 at SUSE CVE-2015-0206 at NVD SUSE bug 912292 SUSE bug 927623 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. Critical CVE-2015-0209 at SUSE CVE-2015-0209 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 936586 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142. Low CVE-2015-0231 at SUSE CVE-2015-0231 at NVD SUSE bug 910659 SUSE bug 924972 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image. Moderate CVE-2015-0232 at SUSE CVE-2015-0232 at NVD SUSE bug 914690 SUSE bug 980366 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." Critical CVE-2015-0235 at SUSE CVE-2015-0235 at NVD SUSE bug 844309 SUSE bug 913646 SUSE bug 949238 SUSE bug 954983 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. Low CVE-2015-0236 at SUSE CVE-2015-0236 at NVD SUSE bug 914693 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction. Moderate CVE-2015-0239 at SUSE CVE-2015-0239 at NVD SUSE bug 987709 SUSE bug 994618 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. Critical CVE-2015-0240 at SUSE CVE-2015-0240 at NVD SUSE bug 917376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow. Moderate CVE-2015-0241 at SUSE CVE-2015-0241 at NVD SUSE bug 916953 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Moderate CVE-2015-0243 at SUSE CVE-2015-0243 at NVD SUSE bug 916953 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation. Moderate CVE-2015-0244 at SUSE CVE-2015-0244 at NVD SUSE bug 916953 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. Moderate CVE-2015-0248 at SUSE CVE-2015-0248 at NVD SUSE bug 923794 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. Low CVE-2015-0251 at SUSE CVE-2015-0251 at NVD SUSE bug 923795 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data. Moderate CVE-2015-0252 at SUSE CVE-2015-0252 at NVD SUSE bug 920810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag. Moderate CVE-2015-0254 at SUSE CVE-2015-0254 at NVD SUSE bug 920813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request. Moderate CVE-2015-0255 at SUSE CVE-2015-0255 at NVD SUSE bug 915810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value. Moderate CVE-2015-0261 at SUSE CVE-2015-0261 at NVD SUSE bug 922220 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file. Low CVE-2015-0267 at SUSE CVE-2015-0267 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215. Moderate CVE-2015-0272 at SUSE CVE-2015-0272 at NVD SUSE bug 1020452 SUSE bug 944296 SUSE bug 951638 SUSE bug 955354 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function. Important CVE-2015-0273 at SUSE CVE-2015-0273 at NVD SUSE bug 917302 SUSE bug 918768 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access. Important CVE-2015-0274 at SUSE CVE-2015-0274 at NVD SUSE bug 919655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request. Moderate CVE-2015-0275 at SUSE CVE-2015-0275 at NVD SUSE bug 919032 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups. Important CVE-2015-0283 at SUSE CVE-2015-0283 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. Critical CVE-2015-0286 at SUSE CVE-2015-0286 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 922496 SUSE bug 936586 SUSE bug 937891 SUSE bug 951391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. Critical CVE-2015-0287 at SUSE CVE-2015-0287 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 922499 SUSE bug 936586 SUSE bug 937891 SUSE bug 968888 SUSE bug 991722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. Critical CVE-2015-0288 at SUSE CVE-2015-0288 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 920236 SUSE bug 936586 SUSE bug 937891 SUSE bug 951391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. Critical CVE-2015-0289 at SUSE CVE-2015-0289 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 922500 SUSE bug 936586 SUSE bug 937891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. Critical CVE-2015-0292 at SUSE CVE-2015-0292 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 922501 SUSE bug 936586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message. Critical CVE-2015-0293 at SUSE CVE-2015-0293 at NVD SUSE bug 912014 SUSE bug 919648 SUSE bug 922488 SUSE bug 936586 SUSE bug 968044 SUSE bug 968051 SUSE bug 968053 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key. Important CVE-2015-0374 at SUSE CVE-2015-0374 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382. Important CVE-2015-0381 at SUSE CVE-2015-0381 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381. Important CVE-2015-0382 at SUSE CVE-2015-0382 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot. Moderate CVE-2015-0383 at SUSE CVE-2015-0383 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. Important CVE-2015-0391 at SUSE CVE-2015-0391 at NVD SUSE bug 914058 SUSE bug 915913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Critical CVE-2015-0395 at SUSE CVE-2015-0395 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Critical CVE-2015-0407 at SUSE CVE-2015-0407 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Critical CVE-2015-0408 at SUSE CVE-2015-0408 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Critical CVE-2015-0410 at SUSE CVE-2015-0410 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption. Important CVE-2015-0411 at SUSE CVE-2015-0411 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. Critical CVE-2015-0412 at SUSE CVE-2015-0412 at NVD SUSE bug 914041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key. Important CVE-2015-0432 at SUSE CVE-2015-0432 at NVD SUSE bug 914058 SUSE bug 915911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML. Low CVE-2015-0433 at SUSE CVE-2015-0433 at NVD SUSE bug 927623 SUSE bug 936409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption. Low CVE-2015-0441 at SUSE CVE-2015-0441 at NVD SUSE bug 927623 SUSE bug 936409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Critical CVE-2015-0460 at SUSE CVE-2015-0460 at NVD SUSE bug 927591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Critical CVE-2015-0469 at SUSE CVE-2015-0469 at NVD SUSE bug 927591 SUSE bug 932310 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot. Critical CVE-2015-0470 at SUSE CVE-2015-0470 at NVD SUSE bug 927591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans. Moderate CVE-2015-0477 at SUSE CVE-2015-0477 at NVD SUSE bug 927591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE. Moderate CVE-2015-0478 at SUSE CVE-2015-0478 at NVD SUSE bug 927591 SUSE bug 944456 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools. Moderate CVE-2015-0480 at SUSE CVE-2015-0480 at NVD SUSE bug 927591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE. Moderate CVE-2015-0488 at SUSE CVE-2015-0488 at NVD SUSE bug 927591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. Low CVE-2015-0499 at SUSE CVE-2015-0499 at NVD SUSE bug 927623 SUSE bug 936408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. Moderate CVE-2015-0501 at SUSE CVE-2015-0501 at NVD SUSE bug 927623 SUSE bug 936408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. Low CVE-2015-0505 at SUSE CVE-2015-0505 at NVD SUSE bug 927623 SUSE bug 936408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory. Moderate CVE-2015-0562 at SUSE CVE-2015-0562 at NVD SUSE bug 912369 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2015-0563 at SUSE CVE-2015-0563 at NVD SUSE bug 912370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session. Moderate CVE-2015-0564 at SUSE CVE-2015-0564 at NVD SUSE bug 912372 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file. Important CVE-2015-0797 at SUSE CVE-2015-0797 at NVD SUSE bug 927559 SUSE bug 930622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. Important CVE-2015-0801 at SUSE CVE-2015-0801 at NVD SUSE bug 925368 SUSE bug 925401 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638. Important CVE-2015-0807 at SUSE CVE-2015-0807 at NVD SUSE bug 913068 SUSE bug 925368 SUSE bug 925398 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. Important CVE-2015-0813 at SUSE CVE-2015-0813 at NVD SUSE bug 925368 SUSE bug 925393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-0815 at SUSE CVE-2015-0815 at NVD SUSE bug 925368 SUSE bug 925392 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. Important CVE-2015-0816 at SUSE CVE-2015-0816 at NVD SUSE bug 925368 SUSE bug 925395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript. Important CVE-2015-0817 at SUSE CVE-2015-0817 at NVD SUSE bug 923495 SUSE bug 923534 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation. Important CVE-2015-0818 at SUSE CVE-2015-0818 at NVD SUSE bug 923495 SUSE bug 923534 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code. Important CVE-2015-0822 at SUSE CVE-2015-0822 at NVD SUSE bug 910669 SUSE bug 917597 SUSE bug 923534 SUSE bug 924515 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic. Important CVE-2015-0827 at SUSE CVE-2015-0827 at NVD SUSE bug 910669 SUSE bug 917597 SUSE bug 923534 SUSE bug 924515 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation. Important CVE-2015-0831 at SUSE CVE-2015-0831 at NVD SUSE bug 910669 SUSE bug 917597 SUSE bug 923534 SUSE bug 924515 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-0836 at SUSE CVE-2015-0836 at NVD SUSE bug 910669 SUSE bug 917597 SUSE bug 923534 SUSE bug 924515 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image. Moderate CVE-2015-0848 at SUSE CVE-2015-0848 at NVD SUSE bug 933109 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code. Critical CVE-2015-1158 at SUSE CVE-2015-1158 at NVD SUSE bug 924208 SUSE bug 976653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/. Critical CVE-2015-1159 at SUSE CVE-2015-1159 at NVD SUSE bug 924208 SUSE bug 976653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys. Moderate CVE-2015-1333 at SUSE CVE-2015-1333 at NVD SUSE bug 1126909 SUSE bug 1185451 SUSE bug 938645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option. Low CVE-2015-1345 at SUSE CVE-2015-1345 at NVD SUSE bug 914695 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use. Moderate CVE-2015-1349 at SUSE CVE-2015-1349 at NVD SUSE bug 918330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. Moderate CVE-2015-1421 at SUSE CVE-2015-1421 at NVD SUSE bug 1115893 SUSE bug 915577 SUSE bug 922004 SUSE bug 939261 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call. Moderate CVE-2015-1472 at SUSE CVE-2015-1472 at NVD SUSE bug 916222 SUSE bug 920341 SUSE bug 922243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call. Moderate CVE-2015-1473 at SUSE CVE-2015-1473 at NVD SUSE bug 916222 SUSE bug 920341 SUSE bug 922243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. Moderate CVE-2015-1547 at SUSE CVE-2015-1547 at NVD SUSE bug 1206220 SUSE bug 914890 SUSE bug 916925 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nft_flush_table function in net/netfilter/nf_tables_api.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability. Moderate CVE-2015-1573 at SUSE CVE-2015-1573 at NVD SUSE bug 917274 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c. Moderate CVE-2015-1593 at SUSE CVE-2015-1593 at NVD SUSE bug 1044934 SUSE bug 917839 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section. Moderate CVE-2015-1779 at SUSE CVE-2015-1779 at NVD SUSE bug 924018 SUSE bug 962632 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer. Moderate CVE-2015-1781 at SUSE CVE-2015-1781 at NVD SUSE bug 1123874 SUSE bug 927080 SUSE bug 979109 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet. Moderate CVE-2015-1782 at SUSE CVE-2015-1782 at NVD SUSE bug 921070 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback. Important CVE-2015-1789 at SUSE CVE-2015-1789 at NVD SUSE bug 934489 SUSE bug 934666 SUSE bug 936586 SUSE bug 937891 SUSE bug 938432 SUSE bug 951391 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data. Moderate CVE-2015-1790 at SUSE CVE-2015-1790 at NVD SUSE bug 934491 SUSE bug 934666 SUSE bug 936586 SUSE bug 938432 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier. Moderate CVE-2015-1791 at SUSE CVE-2015-1791 at NVD SUSE bug 933911 SUSE bug 934666 SUSE bug 986238 SUSE bug 989464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function. Moderate CVE-2015-1792 at SUSE CVE-2015-1792 at NVD SUSE bug 934493 SUSE bug 934666 SUSE bug 937891 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. Important CVE-2015-1798 at SUSE CVE-2015-1798 at NVD SUSE bug 924202 SUSE bug 927497 SUSE bug 928321 SUSE bug 936327 SUSE bug 957163 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. Important CVE-2015-1799 at SUSE CVE-2015-1799 at NVD SUSE bug 924202 SUSE bug 927497 SUSE bug 928321 SUSE bug 936327 SUSE bug 943565 SUSE bug 957163 SUSE bug 959243 SUSE bug 962624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file. Important CVE-2015-1802 at SUSE CVE-2015-1802 at NVD SUSE bug 921978 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file. Important CVE-2015-1803 at SUSE CVE-2015-1803 at NVD SUSE bug 921978 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file. Important CVE-2015-1804 at SUSE CVE-2015-1804 at NVD SUSE bug 921978 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." Important CVE-2015-1805 at SUSE CVE-2015-1805 at NVD SUSE bug 917839 SUSE bug 933429 SUSE bug 939270 SUSE bug 964730 SUSE bug 964732 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name. Critical CVE-2015-1815 at SUSE CVE-2015-1815 at NVD SUSE bug 983452 SUSE bug 984780 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack. Moderate CVE-2015-1819 at SUSE CVE-2015-1819 at NVD SUSE bug 1123919 SUSE bug 928193 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder. Moderate CVE-2015-1821 at SUSE CVE-2015-1821 at NVD SUSE bug 926323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests. Moderate CVE-2015-1822 at SUSE CVE-2015-1822 at NVD SUSE bug 926323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups. Moderate CVE-2015-1827 at SUSE CVE-2015-1827 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag. CVE-2015-1848 at SUSE CVE-2015-1848 at NVD SUSE bug 930578 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets. Moderate CVE-2015-1853 at SUSE CVE-2015-1853 at NVD SUSE bug 926323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. Important CVE-2015-1854 at SUSE CVE-2015-1854 at NVD SUSE bug 929034 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. Low CVE-2015-1863 at SUSE CVE-2015-1863 at NVD SUSE bug 915323 SUSE bug 927558 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command. Important CVE-2015-1867 at SUSE CVE-2015-1867 at NVD SUSE bug 927828 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file. Important CVE-2015-1869 at SUSE CVE-2015-1869 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors. Important CVE-2015-1870 at SUSE CVE-2015-1870 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU). Moderate CVE-2015-2153 at SUSE CVE-2015-2153 at NVD SUSE bug 922221 SUSE bug 922222 SUSE bug 922223 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value. Moderate CVE-2015-2154 at SUSE CVE-2015-2154 at NVD SUSE bug 922222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. Moderate CVE-2015-2155 at SUSE CVE-2015-2155 at NVD SUSE bug 922220 SUSE bug 922221 SUSE bug 922222 SUSE bug 922223 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression. Moderate CVE-2015-2188 at SUSE CVE-2015-2188 at NVD SUSE bug 920696 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. Moderate CVE-2015-2189 at SUSE CVE-2015-2189 at NVD SUSE bug 920697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. Moderate CVE-2015-2191 at SUSE CVE-2015-2191 at NVD SUSE bug 920699 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. Moderate CVE-2015-2301 at SUSE CVE-2015-2301 at NVD SUSE bug 922452 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Moderate CVE-2015-2328 at SUSE CVE-2015-2328 at NVD SUSE bug 906574 SUSE bug 957600 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. Moderate CVE-2015-2348 at SUSE CVE-2015-2348 at NVD SUSE bug 924970 SUSE bug 935227 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges. Moderate CVE-2015-2568 at SUSE CVE-2015-2568 at NVD SUSE bug 927623 SUSE bug 936409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Low CVE-2015-2571 at SUSE CVE-2015-2571 at NVD SUSE bug 927623 SUSE bug 936408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. Low CVE-2015-2573 at SUSE CVE-2015-2573 at NVD SUSE bug 927623 SUSE bug 936409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS. Low CVE-2015-2582 at SUSE CVE-2015-2582 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732. Important CVE-2015-2590 at SUSE CVE-2015-2590 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE. Important CVE-2015-2601 at SUSE CVE-2015-2601 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. Moderate CVE-2015-2620 at SUSE CVE-2015-2620 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX. Important CVE-2015-2621 at SUSE CVE-2015-2621 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE. Important CVE-2015-2625 at SUSE CVE-2015-2625 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. Important CVE-2015-2628 at SUSE CVE-2015-2628 at NVD SUSE bug 937828 SUSE bug 938248 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Important CVE-2015-2632 at SUSE CVE-2015-2632 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Low CVE-2015-2643 at SUSE CVE-2015-2643 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML. Low CVE-2015-2648 at SUSE CVE-2015-2648 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u45 and Java SE Embedded 8u33 allows remote attackers to affect availability via unknown vectors related to Security. Important CVE-2015-2659 at SUSE CVE-2015-2659 at NVD SUSE bug 937828 SUSE bug 938248 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd. Moderate CVE-2015-2666 at SUSE CVE-2015-2666 at NVD SUSE bug 922944 SUSE bug 939044 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account. Important CVE-2015-2675 at SUSE CVE-2015-2675 at NVD SUSE bug 923618 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c. Moderate CVE-2015-2694 at SUSE CVE-2015-2694 at NVD SUSE bug 928978 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response. Moderate CVE-2015-2704 at SUSE CVE-2015-2704 at NVD SUSE bug 1048025 SUSE bug 916766 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2015-2708 at SUSE CVE-2015-2708 at NVD SUSE bug 930622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence. Moderate CVE-2015-2710 at SUSE CVE-2015-2710 at NVD SUSE bug 930622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text. Moderate CVE-2015-2713 at SUSE CVE-2015-2713 at NVD SUSE bug 930622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283. Moderate CVE-2015-2716 at SUSE CVE-2015-2716 at NVD SUSE bug 930622 SUSE bug 939077 SUSE bug 980391 SUSE bug 983985 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker. Important CVE-2015-2722 at SUSE CVE-2015-2722 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-2724 at SUSE CVE-2015-2724 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-2725 at SUSE CVE-2015-2725 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a CVE-2015-0821 regression. Important CVE-2015-2727 at SUSE CVE-2015-2727 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue. Important CVE-2015-2728 at SUSE CVE-2015-2728 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors. Important CVE-2015-2729 at SUSE CVE-2015-2729 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors. Important CVE-2015-2730 at SUSE CVE-2015-2730 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy. Important CVE-2015-2731 at SUSE CVE-2015-2731 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker. Important CVE-2015-2733 at SUSE CVE-2015-2733 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. Important CVE-2015-2734 at SUSE CVE-2015-2734 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. Important CVE-2015-2735 at SUSE CVE-2015-2735 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. Important CVE-2015-2736 at SUSE CVE-2015-2736 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. Important CVE-2015-2737 at SUSE CVE-2015-2737 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. Important CVE-2015-2738 at SUSE CVE-2015-2738 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors. Important CVE-2015-2739 at SUSE CVE-2015-2739 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors. Important CVE-2015-2740 at SUSE CVE-2015-2740 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled. Important CVE-2015-2741 at SUSE CVE-2015-2741 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass. Important CVE-2015-2743 at SUSE CVE-2015-2743 at NVD SUSE bug 863095 SUSE bug 935979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name. Moderate CVE-2015-2775 at SUSE CVE-2015-2775 at NVD SUSE bug 925502 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions. Moderate CVE-2015-2783 at SUSE CVE-2015-2783 at NVD SUSE bug 928408 SUSE bug 928506 SUSE bug 928511 SUSE bug 931418 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231. Important CVE-2015-2787 at SUSE CVE-2015-2787 at NVD SUSE bug 924972 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors. Critical CVE-2015-2806 at SUSE CVE-2015-2806 at NVD SUSE bug 924828 SUSE bug 929414 SUSE bug 961491 SUSE bug 969208 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue. Important CVE-2015-2808 at SUSE CVE-2015-2808 at NVD SUSE bug 925378 SUSE bug 938248 SUSE bug 938895 SUSE bug 952088 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16. Moderate CVE-2015-2830 at SUSE CVE-2015-2830 at NVD SUSE bug 903967 SUSE bug 926240 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message. Moderate CVE-2015-2922 at SUSE CVE-2015-2922 at NVD SUSE bug 903967 SUSE bug 922583 SUSE bug 926223 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922. Moderate CVE-2015-2924 at SUSE CVE-2015-2924 at NVD SUSE bug 926223 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." Moderate CVE-2015-2925 at SUSE CVE-2015-2925 at NVD SUSE bug 926238 SUSE bug 951625 SUSE bug 951638 SUSE bug 963994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application. Important CVE-2015-3142 at SUSE CVE-2015-3142 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015. Moderate CVE-2015-3143 at SUSE CVE-2015-3143 at NVD SUSE bug 927556 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt. Important CVE-2015-3147 at SUSE CVE-2015-3147 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. Moderate CVE-2015-3148 at SUSE CVE-2015-3148 at NVD SUSE bug 1092962 SUSE bug 927746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack. Critical CVE-2015-3149 at SUSE CVE-2015-3149 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method. Important CVE-2015-3150 at SUSE CVE-2015-3150 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method. Important CVE-2015-3151 at SUSE CVE-2015-3151 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack. Moderate CVE-2015-3152 at SUSE CVE-2015-3152 at NVD SUSE bug 1037590 SUSE bug 1047059 SUSE bug 1088681 SUSE bug 924663 SUSE bug 928962 SUSE bug 936407 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges. Important CVE-2015-3159 at SUSE CVE-2015-3159 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. Critical CVE-2015-3165 at SUSE CVE-2015-3165 at NVD SUSE bug 931972 SUSE bug 931973 SUSE bug 931974 SUSE bug 932040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error. Critical CVE-2015-3166 at SUSE CVE-2015-3166 at NVD SUSE bug 931972 SUSE bug 931973 SUSE bug 931974 SUSE bug 932040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack. Critical CVE-2015-3167 at SUSE CVE-2015-3167 at NVD SUSE bug 931972 SUSE bug 931973 SUSE bug 931974 SUSE bug 932040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2015-3182 at SUSE CVE-2015-3182 at NVD SUSE bug 930503 SUSE bug 930689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. Moderate CVE-2015-3183 at SUSE CVE-2015-3183 at NVD SUSE bug 938728 SUSE bug 948325 SUSE bug 949218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Moderate CVE-2015-3184 at SUSE CVE-2015-3184 at NVD SUSE bug 938723 SUSE bug 939514 SUSE bug 939516 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. Moderate CVE-2015-3185 at SUSE CVE-2015-3185 at NVD SUSE bug 938723 SUSE bug 939514 SUSE bug 939516 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Low CVE-2015-3187 at SUSE CVE-2015-3187 at NVD SUSE bug 939517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter. Moderate CVE-2015-3194 at SUSE CVE-2015-3194 at NVD SUSE bug 957812 SUSE bug 957815 SUSE bug 958768 SUSE bug 976341 SUSE bug 990370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application. Moderate CVE-2015-3195 at SUSE CVE-2015-3195 at NVD SUSE bug 923755 SUSE bug 957812 SUSE bug 957815 SUSE bug 958768 SUSE bug 963977 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message. Moderate CVE-2015-3196 at SUSE CVE-2015-3196 at NVD SUSE bug 957813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions. Low CVE-2015-3197 at SUSE CVE-2015-3197 at NVD SUSE bug 963410 SUSE bug 963415 SUSE bug 968044 SUSE bug 968046 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK. Moderate CVE-2015-3204 at SUSE CVE-2015-3204 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls. Moderate CVE-2015-3212 at SUSE CVE-2015-3212 at NVD SUSE bug 936502 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gesture handling code in Clutter before 1.16.2 allows physically proximate attackers to bypass the lock screen via certain (1) mouse or (2) touch gestures. Important CVE-2015-3213 at SUSE CVE-2015-3213 at NVD SUSE bug 933927 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. Moderate CVE-2015-3214 at SUSE CVE-2015-3214 at NVD SUSE bug 934069 SUSE bug 936025 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establishing many TLS sessions to a multithreaded server, leading to use of a negative value for a certain length field. Moderate CVE-2015-3216 at SUSE CVE-2015-3216 at NVD SUSE bug 933898 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. Moderate CVE-2015-3217 at SUSE CVE-2015-3217 at NVD SUSE bug 933878 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets. Important CVE-2015-3223 at SUSE CVE-2015-3223 at NVD SUSE bug 958581 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth. Moderate CVE-2015-3225 at SUSE CVE-2015-3225 at NVD SUSE bug 934797 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password. Moderate CVE-2015-3238 at SUSE CVE-2015-3238 at NVD SUSE bug 1123794 SUSE bug 934920 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet. Moderate CVE-2015-3240 at SUSE CVE-2015-3240 at NVD SUSE bug 943104 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field. Moderate CVE-2015-3245 at SUSE CVE-2015-3245 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges. Important CVE-2015-3246 at SUSE CVE-2015-3246 at NVD SUSE bug 937533 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors. Important CVE-2015-3247 at SUSE CVE-2015-3247 at NVD SUSE bug 944460 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption). Moderate CVE-2015-3248 at SUSE CVE-2015-3248 at NVD SUSE bug 935389 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation." Moderate CVE-2015-3256 at SUSE CVE-2015-3256 at NVD SUSE bug 943816 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job. Important CVE-2015-3258 at SUSE CVE-2015-3258 at NVD SUSE bug 921753 SUSE bug 936281 SUSE bug 937018 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors. Important CVE-2015-3276 at SUSE CVE-2015-3276 at NVD SUSE bug 938567 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow. Important CVE-2015-3279 at SUSE CVE-2015-3279 at NVD SUSE bug 921753 SUSE bug 936281 SUSE bug 937018 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request. Moderate CVE-2015-3281 at SUSE CVE-2015-3281 at NVD SUSE bug 937042 SUSE bug 937202 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive. Important CVE-2015-3307 at SUSE CVE-2015-3307 at NVD SUSE bug 931418 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm. Important CVE-2015-3315 at SUSE CVE-2015-3315 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive. Important CVE-2015-3329 at SUSE CVE-2015-3329 at NVD SUSE bug 928408 SUSE bug 928506 SUSE bug 928511 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter." Moderate CVE-2015-3330 at SUSE CVE-2015-3330 at NVD SUSE bug 908782 SUSE bug 928408 SUSE bug 928506 SUSE bug 928511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. Critical CVE-2015-3331 at SUSE CVE-2015-3331 at NVD SUSE bug 1115893 SUSE bug 927257 SUSE bug 931231 SUSE bug 939262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. Moderate CVE-2015-3339 at SUSE CVE-2015-3339 at NVD SUSE bug 903967 SUSE bug 928130 SUSE bug 939263 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys. Important CVE-2015-3405 at SUSE CVE-2015-3405 at NVD SUSE bug 924202 SUSE bug 928321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files. Moderate CVE-2015-3411 at SUSE CVE-2015-3411 at NVD SUSE bug 935074 SUSE bug 935227 SUSE bug 935229 SUSE bug 935232 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension. Moderate CVE-2015-3412 at SUSE CVE-2015-3412 at NVD SUSE bug 935227 SUSE bug 935229 SUSE bug 935232 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement. Moderate CVE-2015-3414 at SUSE CVE-2015-3414 at NVD SUSE bug 1085790 SUSE bug 1190372 SUSE bug 1193078 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement. Moderate CVE-2015-3415 at SUSE CVE-2015-3415 at NVD SUSE bug 1190372 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement. Moderate CVE-2015-3416 at SUSE CVE-2015-3416 at NVD SUSE bug 1190372 SUSE bug 928700 SUSE bug 928701 SUSE bug 928702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. Moderate CVE-2015-3455 at SUSE CVE-2015-3455 at NVD SUSE bug 929493 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. Moderate CVE-2015-3456 at SUSE CVE-2015-3456 at NVD SUSE bug 929339 SUSE bug 932770 SUSE bug 935900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate. Low CVE-2015-3622 at SUSE CVE-2015-3622 at NVD SUSE bug 929414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. Moderate CVE-2015-3636 at SUSE CVE-2015-3636 at NVD SUSE bug 929525 SUSE bug 939277 SUSE bug 994624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet. Moderate CVE-2015-3810 at SUSE CVE-2015-3810 at NVD SUSE bug 930689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188. Moderate CVE-2015-3811 at SUSE CVE-2015-3811 at NVD SUSE bug 930689 SUSE bug 930691 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet. Moderate CVE-2015-3812 at SUSE CVE-2015-3812 at NVD SUSE bug 930689 SUSE bug 930691 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet. Moderate CVE-2015-3813 at SUSE CVE-2015-3813 at NVD SUSE bug 930689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. Important CVE-2015-4000 at SUSE CVE-2015-4000 at NVD SUSE bug 1074631 SUSE bug 1211968 SUSE bug 931600 SUSE bug 931698 SUSE bug 931723 SUSE bug 931845 SUSE bug 932026 SUSE bug 932483 SUSE bug 934789 SUSE bug 935033 SUSE bug 935540 SUSE bug 935979 SUSE bug 937202 SUSE bug 937766 SUSE bug 938248 SUSE bug 938432 SUSE bug 938895 SUSE bug 938905 SUSE bug 938906 SUSE bug 938913 SUSE bug 938945 SUSE bug 943664 SUSE bug 944729 SUSE bug 945582 SUSE bug 955589 SUSE bug 980406 SUSE bug 990592 SUSE bug 994144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive. Moderate CVE-2015-4021 at SUSE CVE-2015-4021 at NVD SUSE bug 931769 SUSE bug 935074 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. Moderate CVE-2015-4022 at SUSE CVE-2015-4022 at NVD SUSE bug 931769 SUSE bug 931772 SUSE bug 935275 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome. Moderate CVE-2015-4024 at SUSE CVE-2015-4024 at NVD SUSE bug 931421 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. Important CVE-2015-4025 at SUSE CVE-2015-4025 at NVD SUSE bug 1067090 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. Moderate CVE-2015-4026 at SUSE CVE-2015-4026 at NVD SUSE bug 931776 SUSE bug 935227 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read. Moderate CVE-2015-4142 at SUSE CVE-2015-4142 at NVD SUSE bug 915323 SUSE bug 930078 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue. Moderate CVE-2015-4147 at SUSE CVE-2015-4147 at NVD SUSE bug 925109 SUSE bug 933227 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue. Low CVE-2015-4148 at SUSE CVE-2015-4148 at NVD SUSE bug 933227 SUSE bug 935074 SUSE bug 935226 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread. Low CVE-2015-4170 at SUSE CVE-2015-4170 at NVD SUSE bug 933423 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-4473 at SUSE CVE-2015-4473 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file. Important CVE-2015-4475 at SUSE CVE-2015-4475 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method. Important CVE-2015-4478 at SUSE CVE-2015-4478 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data. Important CVE-2015-4479 at SUSE CVE-2015-4479 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding. Important CVE-2015-4480 at SUSE CVE-2015-4480 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object. Important CVE-2015-4484 at SUSE CVE-2015-4484 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data. Important CVE-2015-4485 at SUSE CVE-2015-4485 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data. Important CVE-2015-4486 at SUSE CVE-2015-4486 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Important CVE-2015-4487 at SUSE CVE-2015-4487 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment. Important CVE-2015-4488 at SUSE CVE-2015-4488 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment. Important CVE-2015-4489 at SUSE CVE-2015-4489 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. Moderate CVE-2015-4491 at SUSE CVE-2015-4491 at NVD SUSE bug 940806 SUSE bug 942801 SUSE bug 948790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object. Important CVE-2015-4492 at SUSE CVE-2015-4492 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539. Important CVE-2015-4493 at SUSE CVE-2015-4493 at NVD SUSE bug 940806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015. Important CVE-2015-4495 at SUSE CVE-2015-4495 at NVD SUSE bug 863095 SUSE bug 940806 SUSE bug 940918 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element. Moderate CVE-2015-4497 at SUSE CVE-2015-4497 at NVD SUSE bug 943550 SUSE bug 943557 SUSE bug 943608 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process. Moderate CVE-2015-4498 at SUSE CVE-2015-4498 at NVD SUSE bug 943550 SUSE bug 943558 SUSE bug 943608 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-4500 at SUSE CVE-2015-4500 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176. Important CVE-2015-4509 at SUSE CVE-2015-4509 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation. Moderate CVE-2015-4510 at SUSE CVE-2015-4510 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2015-4513 at SUSE CVE-2015-4513 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Important CVE-2015-4517 at SUSE CVE-2015-4517 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element. Important CVE-2015-4519 at SUSE CVE-2015-4519 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header. Important CVE-2015-4520 at SUSE CVE-2015-4520 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Important CVE-2015-4521 at SUSE CVE-2015-4521 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Important CVE-2015-4522 at SUSE CVE-2015-4522 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file. Moderate CVE-2015-4588 at SUSE CVE-2015-4588 at NVD SUSE bug 933109 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files. Moderate CVE-2015-4598 at SUSE CVE-2015-4598 at NVD SUSE bug 935227 SUSE bug 935232 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Moderate CVE-2015-4599 at SUSE CVE-2015-4599 at NVD SUSE bug 935074 SUSE bug 935226 SUSE bug 935234 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods. Moderate CVE-2015-4600 at SUSE CVE-2015-4600 at NVD SUSE bug 935226 SUSE bug 935234 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600. Moderate CVE-2015-4601 at SUSE CVE-2015-4601 at NVD SUSE bug 935226 SUSE bug 935234 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Moderate CVE-2015-4602 at SUSE CVE-2015-4602 at NVD SUSE bug 935074 SUSE bug 935224 SUSE bug 935226 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue. Moderate CVE-2015-4603 at SUSE CVE-2015-4603 at NVD SUSE bug 935074 SUSE bug 935226 SUSE bug 935234 SUSE bug 980366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule. Important CVE-2015-4604 at SUSE CVE-2015-4604 at NVD SUSE bug 935225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule. Important CVE-2015-4605 at SUSE CVE-2015-4605 at NVD SUSE bug 935225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone. Critical CVE-2015-4620 at SUSE CVE-2015-4620 at NVD SUSE bug 936476 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file. Moderate CVE-2015-4695 at SUSE CVE-2015-4695 at NVD SUSE bug 936058 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command. Moderate CVE-2015-4696 at SUSE CVE-2015-4696 at NVD SUSE bug 936062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler. Moderate CVE-2015-4700 at SUSE CVE-2015-4700 at NVD SUSE bug 935705 SUSE bug 939273 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Important CVE-2015-4731 at SUSE CVE-2015-4731 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590. Important CVE-2015-4732 at SUSE CVE-2015-4732 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Important CVE-2015-4733 at SUSE CVE-2015-4733 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS. Moderate CVE-2015-4734 at SUSE CVE-2015-4734 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth. Low CVE-2015-4737 at SUSE CVE-2015-4737 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. Important CVE-2015-4748 at SUSE CVE-2015-4748 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI. Important CVE-2015-4749 at SUSE CVE-2015-4749 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S. Low CVE-2015-4752 at SUSE CVE-2015-4752 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Low CVE-2015-4757 at SUSE CVE-2015-4757 at NVD SUSE bug 938412 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Important CVE-2015-4760 at SUSE CVE-2015-4760 at NVD SUSE bug 937828 SUSE bug 938248 SUSE bug 938895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802. Important CVE-2015-4792 at SUSE CVE-2015-4792 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792. Important CVE-2015-4802 at SUSE CVE-2015-4802 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911. Moderate CVE-2015-4803 at SUSE CVE-2015-4803 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization. Moderate CVE-2015-4805 at SUSE CVE-2015-4805 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Moderate CVE-2015-4806 at SUSE CVE-2015-4806 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. Important CVE-2015-4815 at SUSE CVE-2015-4815 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. Important CVE-2015-4816 at SUSE CVE-2015-4816 at NVD SUSE bug 951391 SUSE bug 958790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs. Important CVE-2015-4819 at SUSE CVE-2015-4819 at NVD SUSE bug 951391 SUSE bug 958790 SUSE bug 969667 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. Important CVE-2015-4826 at SUSE CVE-2015-4826 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. Important CVE-2015-4830 at SUSE CVE-2015-4830 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881. Moderate CVE-2015-4835 at SUSE CVE-2015-4835 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP. Important CVE-2015-4836 at SUSE CVE-2015-4836 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D. Moderate CVE-2015-4840 at SUSE CVE-2015-4840 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP. Moderate CVE-2015-4842 at SUSE CVE-2015-4842 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Moderate CVE-2015-4843 at SUSE CVE-2015-4843 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Moderate CVE-2015-4844 at SUSE CVE-2015-4844 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913. Important CVE-2015-4858 at SUSE CVE-2015-4858 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883. Moderate CVE-2015-4860 at SUSE CVE-2015-4860 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. Important CVE-2015-4861 at SUSE CVE-2015-4861 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u60 and Java SE Embedded 8u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Moderate CVE-2015-4868 at SUSE CVE-2015-4868 at NVD SUSE bug 951376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. Important CVE-2015-4870 at SUSE CVE-2015-4870 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Moderate CVE-2015-4871 at SUSE CVE-2015-4871 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security. Moderate CVE-2015-4872 at SUSE CVE-2015-4872 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML. Important CVE-2015-4879 at SUSE CVE-2015-4879 at NVD SUSE bug 951391 SUSE bug 958790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835. Critical CVE-2015-4881 at SUSE CVE-2015-4881 at NVD SUSE bug 951376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA. Moderate CVE-2015-4882 at SUSE CVE-2015-4882 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860. Moderate CVE-2015-4883 at SUSE CVE-2015-4883 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911. Moderate CVE-2015-4893 at SUSE CVE-2015-4893 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI. Moderate CVE-2015-4903 at SUSE CVE-2015-4903 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893. Moderate CVE-2015-4911 at SUSE CVE-2015-4911 at NVD SUSE bug 951376 SUSE bug 955131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858. Important CVE-2015-4913 at SUSE CVE-2015-4913 at NVD SUSE bug 951391 SUSE bug 958789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. Critical CVE-2015-5073 at SUSE CVE-2015-5073 at NVD SUSE bug 936227 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands. Important CVE-2015-5154 at SUSE CVE-2015-5154 at NVD SUSE bug 938344 SUSE bug 950367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets. Moderate CVE-2015-5156 at SUSE CVE-2015-5156 at NVD SUSE bug 1091815 SUSE bug 1123903 SUSE bug 940776 SUSE bug 945048 SUSE bug 951638 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI. Important CVE-2015-5157 at SUSE CVE-2015-5157 at NVD SUSE bug 1072204 SUSE bug 1115893 SUSE bug 937969 SUSE bug 937970 SUSE bug 938706 SUSE bug 939207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing. Moderate CVE-2015-5160 at SUSE CVE-2015-5160 at NVD SUSE bug 939348 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors. Moderate CVE-2015-5165 at SUSE CVE-2015-5165 at NVD SUSE bug 939712 SUSE bug 950367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. Moderate CVE-2015-5174 at SUSE CVE-2015-5174 at NVD SUSE bug 967967 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash). Important CVE-2015-5180 at SUSE CVE-2015-5180 at NVD SUSE bug 1123874 SUSE bug 1215582 SUSE bug 941234 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated. Moderate CVE-2015-5189 at SUSE CVE-2015-5189 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. Critical CVE-2015-5190 at SUSE CVE-2015-5190 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands. Low CVE-2015-5194 at SUSE CVE-2015-5194 at NVD SUSE bug 943216 SUSE bug 943218 SUSE bug 943219 SUSE bug 943221 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation. Low CVE-2015-5195 at SUSE CVE-2015-5195 at NVD SUSE bug 943216 SUSE bug 943218 SUSE bug 943219 SUSE bug 943221 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7703. Reason: This candidate is a reservation duplicate of CVE-2015-7703. Notes: All CVE users should reference CVE-2015-7703 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2015-5196 at SUSE CVE-2015-5196 at NVD SUSE bug 1010964 SUSE bug 943216 SUSE bug 943218 SUSE bug 943219 SUSE bug 943221 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. Important CVE-2015-5203 at SUSE CVE-2015-5203 at NVD SUSE bug 1178702 SUSE bug 941919 SUSE bug 942553 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet. Important CVE-2015-5219 at SUSE CVE-2015-5219 at NVD SUSE bug 1010964 SUSE bug 943216 SUSE bug 943218 SUSE bug 943219 SUSE bug 943221 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. Important CVE-2015-5221 at SUSE CVE-2015-5221 at NVD SUSE bug 1178702 SUSE bug 942553 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors. Low CVE-2015-5229 at SUSE CVE-2015-5229 at NVD SUSE bug 943015 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share. Moderate CVE-2015-5252 at SUSE CVE-2015-5252 at NVD SUSE bug 958582 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter. Important CVE-2015-5260 at SUSE CVE-2015-5260 at NVD SUSE bug 944787 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation. Important CVE-2015-5261 at SUSE CVE-2015-5261 at NVD SUSE bug 948976 SUSE bug 982386 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. Moderate CVE-2015-5273 at SUSE CVE-2015-5273 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database. Important CVE-2015-5277 at SUSE CVE-2015-5277 at NVD SUSE bug 1123874 SUSE bug 945830 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu. Low CVE-2015-5281 at SUSE CVE-2015-5281 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished. Moderate CVE-2015-5283 at SUSE CVE-2015-5283 at NVD SUSE bug 947155 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump. Moderate CVE-2015-5287 at SUSE CVE-2015-5287 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt. Low CVE-2015-5288 at SUSE CVE-2015-5288 at NVD SUSE bug 949669 SUSE bug 949670 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values. Moderate CVE-2015-5289 at SUSE CVE-2015-5289 at NVD SUSE bug 949669 SUSE bug 949670 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication. Moderate CVE-2015-5292 at SUSE CVE-2015-5292 at NVD SUSE bug 948819 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c. Moderate CVE-2015-5296 at SUSE CVE-2015-5296 at NVD SUSE bug 1058622 SUSE bug 958584 SUSE bug 973031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory. Low CVE-2015-5299 at SUSE CVE-2015-5299 at NVD SUSE bug 958583 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart). Important CVE-2015-5300 at SUSE CVE-2015-5300 at NVD SUSE bug 951629 SUSE bug 959243 SUSE bug 962624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report. Moderate CVE-2015-5302 at SUSE CVE-2015-5302 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c. Moderate CVE-2015-5307 at SUSE CVE-2015-5307 at NVD SUSE bug 953527 SUSE bug 954018 SUSE bug 954404 SUSE bug 954405 SUSE bug 962977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660. Important CVE-2015-5312 at SUSE CVE-2015-5312 at NVD SUSE bug 1123919 SUSE bug 957105 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. Low CVE-2015-5313 at SUSE CVE-2015-5313 at NVD SUSE bug 953110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value. Low CVE-2015-5330 at SUSE CVE-2015-5330 at NVD SUSE bug 958581 SUSE bug 958586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. Moderate CVE-2015-5345 at SUSE CVE-2015-5345 at NVD SUSE bug 967965 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. Moderate CVE-2015-5346 at SUSE CVE-2015-5346 at NVD SUSE bug 967814 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token. Moderate CVE-2015-5351 at SUSE CVE-2015-5351 at NVD SUSE bug 967812 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood. Moderate CVE-2015-5364 at SUSE CVE-2015-5364 at NVD SUSE bug 1115893 SUSE bug 781018 SUSE bug 936831 SUSE bug 939276 SUSE bug 945112 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364. Moderate CVE-2015-5366 at SUSE CVE-2015-5366 at NVD SUSE bug 781018 SUSE bug 936831 SUSE bug 939276 SUSE bug 945112 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors. Important CVE-2015-5370 at SUSE CVE-2015-5370 at NVD SUSE bug 936862 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Moderate CVE-2015-5477 at SUSE CVE-2015-5477 at NVD SUSE bug 1000362 SUSE bug 939567 SUSE bug 980168 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list. Important CVE-2015-5600 at SUSE CVE-2015-5600 at NVD SUSE bug 1009988 SUSE bug 1074631 SUSE bug 1138392 SUSE bug 938746 SUSE bug 943006 SUSE bug 943007 SUSE bug 943010 SUSE bug 943504 SUSE bug 945985 SUSE bug 948086 SUSE bug 954457 SUSE bug 957883 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. Important CVE-2015-5621 at SUSE CVE-2015-5621 at NVD SUSE bug 1111123 SUSE bug 940188 SUSE bug 969779 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone. Important CVE-2015-5722 at SUSE CVE-2015-5722 at NVD SUSE bug 944066 SUSE bug 944107 SUSE bug 954983 SUSE bug 958861 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions. Moderate CVE-2015-6243 at SUSE CVE-2015-6243 at NVD SUSE bug 941500 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2015-6244 at SUSE CVE-2015-6244 at NVD SUSE bug 941500 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Moderate CVE-2015-6245 at SUSE CVE-2015-6245 at NVD SUSE bug 941500 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2015-6246 at SUSE CVE-2015-6246 at NVD SUSE bug 941500 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Moderate CVE-2015-6248 at SUSE CVE-2015-6248 at NVD SUSE bug 941500 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. Important CVE-2015-6360 at SUSE CVE-2015-6360 at NVD SUSE bug 957376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace. Moderate CVE-2015-6526 at SUSE CVE-2015-6526 at NVD SUSE bug 942702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. Moderate CVE-2015-6563 at SUSE CVE-2015-6563 at NVD SUSE bug 1074631 SUSE bug 943006 SUSE bug 943007 SUSE bug 943010 SUSE bug 948086 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. Moderate CVE-2015-6564 at SUSE CVE-2015-6564 at NVD SUSE bug 1074631 SUSE bug 1138392 SUSE bug 942850 SUSE bug 943006 SUSE bug 943007 SUSE bug 943010 SUSE bug 948086 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. Important CVE-2015-6908 at SUSE CVE-2015-6908 at NVD SUSE bug 945582 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Important CVE-2015-7174 at SUSE CVE-2015-7174 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Important CVE-2015-7175 at SUSE CVE-2015-7175 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function, which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors. Important CVE-2015-7176 at SUSE CVE-2015-7176 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Important CVE-2015-7177 at SUSE CVE-2015-7177 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Important CVE-2015-7180 at SUSE CVE-2015-7180 at NVD SUSE bug 947003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue. Important CVE-2015-7181 at SUSE CVE-2015-7181 at NVD SUSE bug 952810 SUSE bug 962977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data. Important CVE-2015-7182 at SUSE CVE-2015-7182 at NVD SUSE bug 952810 SUSE bug 962977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. Important CVE-2015-7183 at SUSE CVE-2015-7183 at NVD SUSE bug 952810 SUSE bug 962977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string. Important CVE-2015-7188 at SUSE CVE-2015-7188 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code. Important CVE-2015-7189 at SUSE CVE-2015-7189 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, which allows remote attackers to bypass the Same Origin Policy by leveraging the lack of a preflight-request step. Important CVE-2015-7193 at SUSE CVE-2015-7193 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP archive. Important CVE-2015-7194 at SUSE CVE-2015-7194 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper. Important CVE-2015-7196 at SUSE CVE-2015-7196 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code. Important CVE-2015-7197 at SUSE CVE-2015-7197 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data. Important CVE-2015-7198 at SUSE CVE-2015-7198 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document. Important CVE-2015-7199 at SUSE CVE-2015-7199 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key. Important CVE-2015-7200 at SUSE CVE-2015-7200 at NVD SUSE bug 952810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Critical CVE-2015-7201 at SUSE CVE-2015-7201 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet. Critical CVE-2015-7205 at SUSE CVE-2015-7205 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function. Moderate CVE-2015-7210 at SUSE CVE-2015-7210 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation. Important CVE-2015-7212 at SUSE CVE-2015-7212 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow. Moderate CVE-2015-7213 at SUSE CVE-2015-7213 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs. Moderate CVE-2015-7214 at SUSE CVE-2015-7214 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow. Moderate CVE-2015-7222 at SUSE CVE-2015-7222 at NVD SUSE bug 959277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code. Important CVE-2015-7236 at SUSE CVE-2015-7236 at NVD SUSE bug 940191 SUSE bug 946204 SUSE bug 979097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key. Low CVE-2015-7496 at SUSE CVE-2015-7496 at NVD SUSE bug 955552 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors. Moderate CVE-2015-7497 at SUSE CVE-2015-7497 at NVD SUSE bug 1123919 SUSE bug 957106 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure. Moderate CVE-2015-7498 at SUSE CVE-2015-7498 at NVD SUSE bug 1123919 SUSE bug 957107 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors. Moderate CVE-2015-7499 at SUSE CVE-2015-7499 at NVD SUSE bug 1123919 SUSE bug 957109 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags. Moderate CVE-2015-7500 at SUSE CVE-2015-7500 at NVD SUSE bug 1123919 SUSE bug 957110 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. Critical CVE-2015-7501 at SUSE CVE-2015-7501 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date. Important CVE-2015-7529 at SUSE CVE-2015-7529 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets. Important CVE-2015-7540 at SUSE CVE-2015-7540 at NVD SUSE bug 958580 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Important CVE-2015-7547 at SUSE CVE-2015-7547 at NVD SUSE bug 1077097 SUSE bug 847227 SUSE bug 961721 SUSE bug 967023 SUSE bug 967061 SUSE bug 967072 SUSE bug 967496 SUSE bug 969216 SUSE bug 969241 SUSE bug 969591 SUSE bug 986086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image. Important CVE-2015-7554 at SUSE CVE-2015-7554 at NVD SUSE bug 1007276 SUSE bug 1017690 SUSE bug 1040322 SUSE bug 960341 SUSE bug 974621 SUSE bug 983436 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content. Moderate CVE-2015-7560 at SUSE CVE-2015-7560 at NVD SUSE bug 968222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. Moderate CVE-2015-7575 at SUSE CVE-2015-7575 at NVD SUSE bug 959888 SUSE bug 960402 SUSE bug 960996 SUSE bug 961280 SUSE bug 961281 SUSE bug 961282 SUSE bug 961283 SUSE bug 961284 SUSE bug 961290 SUSE bug 961357 SUSE bug 962743 SUSE bug 963937 SUSE bug 967521 SUSE bug 981087 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c. Important CVE-2015-7613 at SUSE CVE-2015-7613 at NVD SUSE bug 923755 SUSE bug 948536 SUSE bug 948701 SUSE bug 963994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. Important CVE-2015-7691 at SUSE CVE-2015-7691 at NVD SUSE bug 1010964 SUSE bug 911792 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. Important CVE-2015-7692 at SUSE CVE-2015-7692 at NVD SUSE bug 1010964 SUSE bug 911792 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption). Important CVE-2015-7701 at SUSE CVE-2015-7701 at NVD SUSE bug 1010964 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. Important CVE-2015-7702 at SUSE CVE-2015-7702 at NVD SUSE bug 1010964 SUSE bug 911792 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command. Important CVE-2015-7703 at SUSE CVE-2015-7703 at NVD SUSE bug 1010964 SUSE bug 943216 SUSE bug 943218 SUSE bug 943219 SUSE bug 943221 SUSE bug 951608 SUSE bug 959243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. Important CVE-2015-7704 at SUSE CVE-2015-7704 at NVD SUSE bug 1010964 SUSE bug 951608 SUSE bug 952611 SUSE bug 959243 SUSE bug 977446 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot. Moderate CVE-2015-7837 at SUSE CVE-2015-7837 at NVD SUSE bug 950804 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. Moderate CVE-2015-7852 at SUSE CVE-2015-7852 at NVD SUSE bug 1010964 SUSE bug 951608 SUSE bug 959243 SUSE bug 992991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands. Moderate CVE-2015-7872 at SUSE CVE-2015-7872 at NVD SUSE bug 951440 SUSE bug 951542 SUSE bug 951638 SUSE bug 958463 SUSE bug 958601 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. Low CVE-2015-7941 at SUSE CVE-2015-7941 at NVD SUSE bug 1123919 SUSE bug 951734 SUSE bug 951735 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941. Low CVE-2015-7942 at SUSE CVE-2015-7942 at NVD SUSE bug 1123919 SUSE bug 951735 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." Low CVE-2015-7974 at SUSE CVE-2015-7974 at NVD SUSE bug 959243 SUSE bug 962960 SUSE bug 962995 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command. Moderate CVE-2015-7977 at SUSE CVE-2015-7977 at NVD SUSE bug 959243 SUSE bug 962970 SUSE bug 962995 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list. Moderate CVE-2015-7978 at SUSE CVE-2015-7978 at NVD SUSE bug 959243 SUSE bug 962970 SUSE bug 962995 SUSE bug 963000 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client. Moderate CVE-2015-7979 at SUSE CVE-2015-7979 at NVD SUSE bug 959243 SUSE bug 962784 SUSE bug 962995 SUSE bug 977459 SUSE bug 982065 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read. Moderate CVE-2015-7981 at SUSE CVE-2015-7981 at NVD SUSE bug 952051 SUSE bug 960402 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute. Moderate CVE-2015-8000 at SUSE CVE-2015-8000 at NVD SUSE bug 944066 SUSE bug 958861 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. Low CVE-2015-8035 at SUSE CVE-2015-8035 at NVD SUSE bug 1088279 SUSE bug 1105166 SUSE bug 954429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c. Critical CVE-2015-8104 at SUSE CVE-2015-8104 at NVD SUSE bug 1215748 SUSE bug 953527 SUSE bug 954018 SUSE bug 954404 SUSE bug 954405 SUSE bug 962977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. Moderate CVE-2015-8126 at SUSE CVE-2015-8126 at NVD SUSE bug 954980 SUSE bug 958198 SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 SUSE bug 969333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero. Moderate CVE-2015-8138 at SUSE CVE-2015-8138 at NVD SUSE bug 951608 SUSE bug 959243 SUSE bug 963002 SUSE bug 974668 SUSE bug 977446 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values. Low CVE-2015-8158 at SUSE CVE-2015-8158 at NVD SUSE bug 959243 SUSE bug 962966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. Moderate CVE-2015-8241 at SUSE CVE-2015-8241 at NVD SUSE bug 1123919 SUSE bug 956018 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. Moderate CVE-2015-8242 at SUSE CVE-2015-8242 at NVD SUSE bug 1123919 SUSE bug 956021 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read. Moderate CVE-2015-8317 at SUSE CVE-2015-8317 at NVD SUSE bug 1123919 SUSE bug 956260 SUSE bug 959469 SUSE bug 969769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable. Moderate CVE-2015-8325 at SUSE CVE-2015-8325 at NVD SUSE bug 1138392 SUSE bug 975865 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error. Moderate CVE-2015-8370 at SUSE CVE-2015-8370 at NVD SUSE bug 956631 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action. Low CVE-2015-8374 at SUSE CVE-2015-8374 at NVD SUSE bug 923755 SUSE bug 956053 SUSE bug 963994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Critical CVE-2015-8385 at SUSE CVE-2015-8385 at NVD SUSE bug 957598 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Critical CVE-2015-8386 at SUSE CVE-2015-8386 at NVD SUSE bug 957598 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Critical CVE-2015-8388 at SUSE CVE-2015-8388 at NVD SUSE bug 936227 SUSE bug 957598 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. Critical CVE-2015-8391 at SUSE CVE-2015-8391 at NVD SUSE bug 957598 SUSE bug 958373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126. Moderate CVE-2015-8472 at SUSE CVE-2015-8472 at NVD SUSE bug 954980 SUSE bug 958198 SUSE bug 960402 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c. Important CVE-2015-8539 at SUSE CVE-2015-8539 at NVD SUSE bug 1115893 SUSE bug 781018 SUSE bug 958463 SUSE bug 958601 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. Moderate CVE-2015-8543 at SUSE CVE-2015-8543 at NVD SUSE bug 1020452 SUSE bug 1052256 SUSE bug 1115893 SUSE bug 923755 SUSE bug 958886 SUSE bug 963994 SUSE bug 969522 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string. Low CVE-2015-8629 at SUSE CVE-2015-8629 at NVD SUSE bug 770172 SUSE bug 963968 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name. Low CVE-2015-8630 at SUSE CVE-2015-8630 at NVD SUSE bug 963964 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name. Moderate CVE-2015-8631 at SUSE CVE-2015-8631 at NVD SUSE bug 963975 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application. Important CVE-2015-8660 at SUSE CVE-2015-8660 at NVD SUSE bug 923755 SUSE bug 960281 SUSE bug 960329 SUSE bug 963994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image. Low CVE-2015-8665 at SUSE CVE-2015-8665 at NVD SUSE bug 1156749 SUSE bug 1156754 SUSE bug 1200195 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image. Moderate CVE-2015-8668 at SUSE CVE-2015-8668 at NVD SUSE bug 1014461 SUSE bug 960589 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image. Low CVE-2015-8683 at SUSE CVE-2015-8683 at NVD SUSE bug 1156749 SUSE bug 1156754 SUSE bug 1200195 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record. Moderate CVE-2015-8704 at SUSE CVE-2015-8704 at NVD SUSE bug 962189 SUSE bug 962190 SUSE bug 986950 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic. Important CVE-2015-8746 at SUSE CVE-2015-8746 at NVD SUSE bug 960839 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. Low CVE-2015-8767 at SUSE CVE-2015-8767 at NVD SUSE bug 1020452 SUSE bug 1115893 SUSE bug 961509 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value. Low CVE-2015-8776 at SUSE CVE-2015-8776 at NVD SUSE bug 1123874 SUSE bug 962736 SUSE bug 986086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable. Low CVE-2015-8777 at SUSE CVE-2015-8777 at NVD SUSE bug 1123874 SUSE bug 950944 SUSE bug 962735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access. Low CVE-2015-8778 at SUSE CVE-2015-8778 at NVD SUSE bug 1123874 SUSE bug 962737 SUSE bug 986086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name. Critical CVE-2015-8779 at SUSE CVE-2015-8779 at NVD SUSE bug 1123874 SUSE bug 962739 SUSE bug 965453 SUSE bug 986086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. Moderate CVE-2015-8781 at SUSE CVE-2015-8781 at NVD SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781. Moderate CVE-2015-8782 at SUSE CVE-2015-8782 at NVD SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds reads) via a crafted TIFF image. Moderate CVE-2015-8783 at SUSE CVE-2015-8783 at NVD SUSE bug 964213 SUSE bug 964225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif. Moderate CVE-2015-8784 at SUSE CVE-2015-8784 at NVD SUSE bug 1206220 SUSE bug 1206479 SUSE bug 916925 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805. Moderate CVE-2015-8803 at SUSE CVE-2015-8803 at NVD SUSE bug 964845 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors. Moderate CVE-2015-8804 at SUSE CVE-2015-8804 at NVD SUSE bug 964847 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803. Moderate CVE-2015-8805 at SUSE CVE-2015-8805 at NVD SUSE bug 964849 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets. Moderate CVE-2015-8812 at SUSE CVE-2015-8812 at NVD SUSE bug 1020452 SUSE bug 1115893 SUSE bug 966437 SUSE bug 966683 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression. Important CVE-2015-8830 at SUSE CVE-2015-8830 at NVD SUSE bug 969354 SUSE bug 969355 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling. Moderate CVE-2015-8839 at SUSE CVE-2015-8839 at NVD SUSE bug 972174 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. Moderate CVE-2015-8844 at SUSE CVE-2015-8844 at NVD SUSE bug 975531 SUSE bug 975533 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. Moderate CVE-2015-8845 at SUSE CVE-2015-8845 at NVD SUSE bug 975531 SUSE bug 975533 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the ExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document. Moderate CVE-2015-8868 at SUSE CVE-2015-8868 at NVD SUSE bug 976844 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function. Low CVE-2015-8869 at SUSE CVE-2015-8869 at NVD SUSE bug 977990 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file. Moderate CVE-2015-8870 at SUSE CVE-2015-8870 at NVD SUSE bug 1014461 SUSE bug 1150480 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow. Moderate CVE-2015-8895 at SUSE CVE-2015-8895 at NVD SUSE bug 982969 SUSE bug 983527 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file. Moderate CVE-2015-8896 at SUSE CVE-2015-8896 at NVD SUSE bug 982969 SUSE bug 983533 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file. Low CVE-2015-8897 at SUSE CVE-2015-8897 at NVD SUSE bug 982969 SUSE bug 983739 SUSE bug 983746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file. Moderate CVE-2015-8898 at SUSE CVE-2015-8898 at NVD SUSE bug 982969 SUSE bug 983739 SUSE bug 983746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file. Moderate CVE-2015-8916 at SUSE CVE-2015-8916 at NVD SUSE bug 985694 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file. Moderate CVE-2015-8917 at SUSE CVE-2015-8917 at NVD SUSE bug 985691 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file. Moderate CVE-2015-8919 at SUSE CVE-2015-8919 at NVD SUSE bug 985697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file. Moderate CVE-2015-8920 at SUSE CVE-2015-8920 at NVD SUSE bug 985675 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file. Moderate CVE-2015-8921 at SUSE CVE-2015-8921 at NVD SUSE bug 985682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct. Moderate CVE-2015-8922 at SUSE CVE-2015-8922 at NVD SUSE bug 985685 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file. Moderate CVE-2015-8923 at SUSE CVE-2015-8923 at NVD SUSE bug 985703 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file. Moderate CVE-2015-8924 at SUSE CVE-2015-8924 at NVD SUSE bug 985609 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing. Moderate CVE-2015-8925 at SUSE CVE-2015-8925 at NVD SUSE bug 985706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive. Moderate CVE-2015-8926 at SUSE CVE-2015-8926 at NVD SUSE bug 985704 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file. Moderate CVE-2015-8928 at SUSE CVE-2015-8928 at NVD SUSE bug 985679 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself. Moderate CVE-2015-8930 at SUSE CVE-2015-8930 at NVD SUSE bug 985700 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior. Moderate CVE-2015-8931 at SUSE CVE-2015-8931 at NVD SUSE bug 985689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift. Moderate CVE-2015-8932 at SUSE CVE-2015-8932 at NVD SUSE bug 985665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file. Moderate CVE-2015-8934 at SUSE CVE-2015-8934 at NVD SUSE bug 985673 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket. Moderate CVE-2015-8956 at SUSE CVE-2015-8956 at NVD SUSE bug 1003925 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c. Moderate CVE-2015-8970 at SUSE CVE-2015-8970 at NVD SUSE bug 1008374 SUSE bug 1008850 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. Moderate CVE-2015-9251 at SUSE CVE-2015-9251 at NVD SUSE bug 1099458 SUSE bug 1100133 SUSE bug 1111660 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow. Moderate CVE-2015-9262 at SUSE CVE-2015-9262 at NVD SUSE bug 1103511 SUSE bug 1123801 SUSE bug 1159415 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23. Moderate CVE-2015-9289 at SUSE CVE-2015-9289 at NVD SUSE bug 1143179 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. Moderate CVE-2015-9381 at SUSE CVE-2015-9381 at NVD SUSE bug 1149384 SUSE Liberty Linux 7 LTSS FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. Moderate CVE-2015-9382 at SUSE CVE-2015-9382 at NVD SUSE bug 1149395 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking. Important CVE-2016-0402 at SUSE CVE-2016-0402 at NVD SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX. Important CVE-2016-0448 at SUSE CVE-2016-0448 at NVD SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP. Important CVE-2016-0466 at SUSE CVE-2016-0466 at NVD SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. Important CVE-2016-0475 at SUSE CVE-2016-0475 at NVD SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. Important CVE-2016-0483 at SUSE CVE-2016-0483 at NVD SUSE bug 960402 SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Important CVE-2016-0494 at SUSE CVE-2016-0494 at NVD SUSE bug 962743 SUSE bug 963937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options. Moderate CVE-2016-0505 at SUSE CVE-2016-0505 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name. Important CVE-2016-0546 at SUSE CVE-2016-0546 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML. Moderate CVE-2016-0596 at SUSE CVE-2016-0596 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. Moderate CVE-2016-0597 at SUSE CVE-2016-0597 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML. Moderate CVE-2016-0598 at SUSE CVE-2016-0598 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. Moderate CVE-2016-0600 at SUSE CVE-2016-0600 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption. Moderate CVE-2016-0606 at SUSE CVE-2016-0606 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF. Moderate CVE-2016-0608 at SUSE CVE-2016-0608 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges. Moderate CVE-2016-0609 at SUSE CVE-2016-0609 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. Moderate CVE-2016-0616 at SUSE CVE-2016-0616 at NVD SUSE bug 962779 SUSE bug 962817 SUSE bug 962930 SUSE bug 962931 SUSE bug 962932 SUSE bug 962934 SUSE bug 962935 SUSE bug 962936 SUSE bug 962937 SUSE bug 962938 SUSE bug 962939 SUSE bug 962941 SUSE bug 962942 SUSE bug 962943 SUSE bug 962944 SUSE bug 962945 SUSE bug 962946 SUSE bug 962947 SUSE bug 962948 SUSE bug 962949 SUSE bug 962950 SUSE bug 962951 SUSE bug 962952 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. Low CVE-2016-0634 at SUSE CVE-2016-0634 at NVD SUSE bug 1000396 SUSE bug 1001299 SUSE bug 1159416 SUSE bug 1188388 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component. Moderate CVE-2016-0636 at SUSE CVE-2016-0636 at NVD SUSE bug 972468 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML. Moderate CVE-2016-0640 at SUSE CVE-2016-0640 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM. Moderate CVE-2016-0641 at SUSE CVE-2016-0641 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML. Moderate CVE-2016-0643 at SUSE CVE-2016-0643 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL. Moderate CVE-2016-0644 at SUSE CVE-2016-0644 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML. Moderate CVE-2016-0646 at SUSE CVE-2016-0646 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS. Moderate CVE-2016-0647 at SUSE CVE-2016-0647 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS. Moderate CVE-2016-0648 at SUSE CVE-2016-0648 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS. Moderate CVE-2016-0649 at SUSE CVE-2016-0649 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication. Moderate CVE-2016-0650 at SUSE CVE-2016-0650 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges. Moderate CVE-2016-0666 at SUSE CVE-2016-0666 at NVD SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. Important CVE-2016-0686 at SUSE CVE-2016-0686 at NVD SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. Important CVE-2016-0687 at SUSE CVE-2016-0687 at NVD SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. Important CVE-2016-0695 at SUSE CVE-2016-0695 at NVD SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack. Moderate CVE-2016-0702 at SUSE CVE-2016-0702 at NVD SUSE bug 1007806 SUSE bug 968044 SUSE bug 968050 SUSE bug 971238 SUSE bug 990370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800. Moderate CVE-2016-0703 at SUSE CVE-2016-0703 at NVD SUSE bug 968044 SUSE bug 968046 SUSE bug 968051 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800. Moderate CVE-2016-0704 at SUSE CVE-2016-0704 at NVD SUSE bug 968044 SUSE bug 968053 SUSE bug 986238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key. Low CVE-2016-0705 at SUSE CVE-2016-0705 at NVD SUSE bug 968044 SUSE bug 968047 SUSE bug 971238 SUSE bug 976341 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. Low CVE-2016-0706 at SUSE CVE-2016-0706 at NVD SUSE bug 967815 SUSE bug 971085 SUSE bug 988489 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. Important CVE-2016-0714 at SUSE CVE-2016-0714 at NVD SUSE bug 967964 SUSE bug 971085 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Moderate CVE-2016-0718 at SUSE CVE-2016-0718 at NVD SUSE bug 979441 SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. Important CVE-2016-0720 at SUSE CVE-2016-0720 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Session fixation vulnerability in pcsd in pcs before 0.9.157. Important CVE-2016-0721 at SUSE CVE-2016-0721 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands. Important CVE-2016-0728 at SUSE CVE-2016-0728 at NVD SUSE bug 923755 SUSE bug 962075 SUSE bug 962078 SUSE bug 963994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document. Critical CVE-2016-0729 at SUSE CVE-2016-0729 at NVD SUSE bug 966822 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC. Low CVE-2016-0736 at SUSE CVE-2016-0736 at NVD SUSE bug 1016712 SUSE bug 1033513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection. Important CVE-2016-0741 at SUSE CVE-2016-0741 at NVD SUSE bug 1069074 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow. Important CVE-2016-0749 at SUSE CVE-2016-0749 at NVD SUSE bug 982385 SUSE bug 982386 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data. Important CVE-2016-0758 at SUSE CVE-2016-0758 at NVD SUSE bug 1020452 SUSE bug 1072204 SUSE bug 1115893 SUSE bug 979867 SUSE bug 980856 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. Low CVE-2016-0762 at SUSE CVE-2016-0762 at NVD SUSE bug 1007854 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. Moderate CVE-2016-0763 at SUSE CVE-2016-0763 at NVD SUSE bug 967966 SUSE bug 971085 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes. Low CVE-2016-0764 at SUSE CVE-2016-0764 at NVD SUSE bug 974072 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression. Moderate CVE-2016-0773 at SUSE CVE-2016-0773 at NVD SUSE bug 966435 SUSE bug 966436 SUSE bug 978323 SUSE bug 983246 SUSE bug 986409 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key. Critical CVE-2016-0777 at SUSE CVE-2016-0777 at NVD SUSE bug 961642 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings. Important CVE-2016-0778 at SUSE CVE-2016-0778 at NVD SUSE bug 961645 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug." Moderate CVE-2016-0787 at SUSE CVE-2016-0787 at NVD SUSE bug 1149968 SUSE bug 967026 SUSE bug 968174 SUSE bug 974691 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c. Important CVE-2016-0797 at SUSE CVE-2016-0797 at NVD SUSE bug 968044 SUSE bug 968048 SUSE bug 990370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. Moderate CVE-2016-0799 at SUSE CVE-2016-0799 at NVD SUSE bug 968044 SUSE bug 968374 SUSE bug 969517 SUSE bug 989345 SUSE bug 990370 SUSE bug 991722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack. Moderate CVE-2016-0800 at SUSE CVE-2016-0800 at NVD SUSE bug 1106871 SUSE bug 961377 SUSE bug 968044 SUSE bug 968046 SUSE bug 968888 SUSE bug 969591 SUSE bug 979060 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. Moderate CVE-2016-1000110 at SUSE CVE-2016-1000110 at NVD SUSE bug 988484 SUSE bug 989523 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Moderate CVE-2016-1000111 at SUSE CVE-2016-1000111 at NVD SUSE bug 989997 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information. Moderate CVE-2016-10002 at SUSE CVE-2016-10002 at NVD SUSE bug 1016168 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket. Moderate CVE-2016-10009 at SUSE CVE-2016-10009 at NVD SUSE bug 1016336 SUSE bug 1016366 SUSE bug 1016370 SUSE bug 1026634 SUSE bug 1138392 SUSE bug 1213504 SUSE bug 1217035 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process. Moderate CVE-2016-10011 at SUSE CVE-2016-10011 at NVD SUSE bug 1016336 SUSE bug 1016369 SUSE bug 1016370 SUSE bug 1017870 SUSE bug 1026634 SUSE bug 1029445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures. Moderate CVE-2016-10012 at SUSE CVE-2016-10012 at NVD SUSE bug 1006166 SUSE bug 1016336 SUSE bug 1016369 SUSE bug 1016370 SUSE bug 1017870 SUSE bug 1026634 SUSE bug 1035742 SUSE bug 1073044 SUSE bug 1092582 SUSE bug 1138392 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576. Important CVE-2016-10088 at SUSE CVE-2016-10088 at NVD SUSE bug 1013604 SUSE bug 1014271 SUSE bug 1017710 SUSE bug 1019079 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5). Moderate CVE-2016-10147 at SUSE CVE-2016-10147 at NVD SUSE bug 1020381 SUSE bug 1020429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow. Important CVE-2016-10164 at SUSE CVE-2016-10164 at NVD SUSE bug 1021315 SUSE bug 1123144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file. Low CVE-2016-10167 at SUSE CVE-2016-10167 at NVD SUSE bug 1022069 SUSE bug 1022264 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image. Moderate CVE-2016-10168 at SUSE CVE-2016-10168 at NVD SUSE bug 1022069 SUSE bug 1022265 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read. Low CVE-2016-10195 at SUSE CVE-2016-10195 at NVD SUSE bug 1022917 SUSE bug 1035082 SUSE bug 1035209 SUSE bug 1075618 SUSE bug 1123122 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument. Moderate CVE-2016-10196 at SUSE CVE-2016-10196 at NVD SUSE bug 1022918 SUSE bug 1035082 SUSE bug 1035209 SUSE bug 1075618 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. Moderate CVE-2016-10197 at SUSE CVE-2016-10197 at NVD SUSE bug 1022919 SUSE bug 1035082 SUSE bug 1035209 SUSE bug 1075618 SUSE bug 1123122 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file. Low CVE-2016-10198 at SUSE CVE-2016-10198 at NVD SUSE bug 1023259 SUSE bug 1024014 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value. Low CVE-2016-10199 at SUSE CVE-2016-10199 at NVD SUSE bug 1023259 SUSE bug 1024017 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c. Moderate CVE-2016-10200 at SUSE CVE-2016-10200 at NVD SUSE bug 1027179 SUSE bug 1028415 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early. Important CVE-2016-10207 at SUSE CVE-2016-10207 at NVD SUSE bug 1023012 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image. Moderate CVE-2016-10208 at SUSE CVE-2016-10208 at NVD SUSE bug 1023377 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. Moderate CVE-2016-10245 at SUSE CVE-2016-10245 at NVD SUSE bug 1136364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence. Moderate CVE-2016-10248 at SUSE CVE-2016-10248 at NVD SUSE bug 1029705 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow. Important CVE-2016-10249 at SUSE CVE-2016-10249 at NVD SUSE bug 1029704 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value. Moderate CVE-2016-10251 at SUSE CVE-2016-10251 at NVD SUSE bug 1029497 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. Moderate CVE-2016-10713 at SUSE CVE-2016-10713 at NVD SUSE bug 1080918 SUSE bug 1101128 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. Moderate CVE-2016-10735 at SUSE CVE-2016-10735 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings. Moderate CVE-2016-10739 at SUSE CVE-2016-10739 at NVD SUSE bug 1122729 SUSE bug 1155094 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. Important CVE-2016-10745 at SUSE CVE-2016-10745 at NVD SUSE bug 1132174 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. Moderate CVE-2016-1248 at SUSE CVE-2016-1248 at NVD SUSE bug 1010685 SUSE bug 1173534 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c. Moderate CVE-2016-1285 at SUSE CVE-2016-1285 at NVD SUSE bug 970072 SUSE bug 981200 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. Moderate CVE-2016-1286 at SUSE CVE-2016-1286 at NVD SUSE bug 970073 SUSE bug 981200 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. Moderate CVE-2016-1521 at SUSE CVE-2016-1521 at NVD SUSE bug 965803 SUSE bug 965806 SUSE bug 965807 SUSE bug 965810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font. Moderate CVE-2016-1522 at SUSE CVE-2016-1522 at NVD SUSE bug 965803 SUSE bug 965806 SUSE bug 965807 SUSE bug 965810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. Moderate CVE-2016-1523 at SUSE CVE-2016-1523 at NVD SUSE bug 965803 SUSE bug 965806 SUSE bug 965807 SUSE bug 965810 SUSE bug 967087 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. Moderate CVE-2016-1526 at SUSE CVE-2016-1526 at NVD SUSE bug 965803 SUSE bug 965806 SUSE bug 965807 SUSE bug 965810 SUSE bug 966438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive. Moderate CVE-2016-1541 at SUSE CVE-2016-1541 at NVD SUSE bug 979005 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled. Moderate CVE-2016-1547 at SUSE CVE-2016-1547 at NVD SUSE bug 962784 SUSE bug 977446 SUSE bug 977459 SUSE bug 982064 SUSE bug 982065 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched. Moderate CVE-2016-1548 at SUSE CVE-2016-1548 at NVD SUSE bug 959243 SUSE bug 977446 SUSE bug 977461 SUSE bug 982068 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key. Low CVE-2016-1550 at SUSE CVE-2016-1550 at NVD SUSE bug 977446 SUSE bug 977464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. Important CVE-2016-1577 at SUSE CVE-2016-1577 at NVD SUSE bug 1178702 SUSE bug 968373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration. Moderate CVE-2016-1714 at SUSE CVE-2016-1714 at NVD SUSE bug 961691 SUSE bug 961692 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1762 at SUSE CVE-2016-1762 at NVD SUSE bug 1123919 SUSE bug 981040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1833 at SUSE CVE-2016-1833 at NVD SUSE bug 1123919 SUSE bug 981108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. Moderate CVE-2016-1834 at SUSE CVE-2016-1834 at NVD SUSE bug 1123919 SUSE bug 981041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. Moderate CVE-2016-1835 at SUSE CVE-2016-1835 at NVD SUSE bug 1123919 SUSE bug 981109 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document. Moderate CVE-2016-1836 at SUSE CVE-2016-1836 at NVD SUSE bug 1174862 SUSE bug 981110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document. Moderate CVE-2016-1837 at SUSE CVE-2016-1837 at NVD SUSE bug 1123919 SUSE bug 981111 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1838 at SUSE CVE-2016-1838 at NVD SUSE bug 1123919 SUSE bug 981112 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Moderate CVE-2016-1839 at SUSE CVE-2016-1839 at NVD SUSE bug 1039069 SUSE bug 1039661 SUSE bug 1069433 SUSE bug 1069690 SUSE bug 1123919 SUSE bug 963963 SUSE bug 981114 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. Moderate CVE-2016-1840 at SUSE CVE-2016-1840 at NVD SUSE bug 1123919 SUSE bug 981115 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image. Moderate CVE-2016-1867 at SUSE CVE-2016-1867 at NVD SUSE bug 1178702 SUSE bug 961886 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server. Low CVE-2016-1908 at SUSE CVE-2016-1908 at NVD SUSE bug 1001712 SUSE bug 1005738 SUSE bug 1010950 SUSE bug 1138392 SUSE bug 962313 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Critical CVE-2016-1930 at SUSE CVE-2016-1930 at NVD SUSE bug 963520 SUSE bug 963632 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content. Moderate CVE-2016-1935 at SUSE CVE-2016-1935 at NVD SUSE bug 963520 SUSE bug 963635 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate. Important CVE-2016-1950 at SUSE CVE-2016-1950 at NVD SUSE bug 969894 SUSE bug 970257 SUSE bug 970377 SUSE bug 970378 SUSE bug 970379 SUSE bug 970380 SUSE bug 970381 SUSE bug 970431 SUSE bug 970433 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2016-1952 at SUSE CVE-2016-1952 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file. Important CVE-2016-1954 at SUSE CVE-2016-1954 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array. Moderate CVE-2016-1957 at SUSE CVE-2016-1957 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL. Moderate CVE-2016-1958 at SUSE CVE-2016-1958 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545. Important CVE-2016-1960 at SUSE CVE-2016-1960 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574. Important CVE-2016-1961 at SUSE CVE-2016-1961 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections. Critical CVE-2016-1962 at SUSE CVE-2016-1962 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. Important CVE-2016-1964 at SUSE CVE-2016-1964 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. Moderate CVE-2016-1965 at SUSE CVE-2016-1965 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin. Important CVE-2016-1966 at SUSE CVE-2016-1966 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors. Important CVE-2016-1973 at SUSE CVE-2016-1973 at NVD SUSE bug 969894 SUSE bug 970257 SUSE bug 970377 SUSE bug 970378 SUSE bug 970379 SUSE bug 970380 SUSE bug 970381 SUSE bug 970431 SUSE bug 970433 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document. Important CVE-2016-1974 at SUSE CVE-2016-1974 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font. Important CVE-2016-1977 at SUSE CVE-2016-1977 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. Important CVE-2016-1978 at SUSE CVE-2016-1978 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. Important CVE-2016-1979 at SUSE CVE-2016-1979 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS. Low CVE-2016-1981 at SUSE CVE-2016-1981 at NVD SUSE bug 963782 SUSE bug 963783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com." Moderate CVE-2016-2047 at SUSE CVE-2016-2047 at NVD SUSE bug 963806 SUSE bug 976341 SUSE bug 980904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c. Moderate CVE-2016-2053 at SUSE CVE-2016-2053 at NVD SUSE bug 1020452 SUSE bug 963762 SUSE bug 979074 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU. Low CVE-2016-2069 at SUSE CVE-2016-2069 at NVD SUSE bug 1020452 SUSE bug 1115893 SUSE bug 870618 SUSE bug 963767 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. Moderate CVE-2016-2089 at SUSE CVE-2016-2089 at NVD SUSE bug 1178702 SUSE bug 963983 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. Low CVE-2016-2105 at SUSE CVE-2016-2105 at NVD SUSE bug 977584 SUSE bug 977614 SUSE bug 978492 SUSE bug 989902 SUSE bug 990369 SUSE bug 990370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. Low CVE-2016-2106 at SUSE CVE-2016-2106 at NVD SUSE bug 977584 SUSE bug 977615 SUSE bug 978492 SUSE bug 979279 SUSE bug 990369 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. Important CVE-2016-2107 at SUSE CVE-2016-2107 at NVD SUSE bug 976942 SUSE bug 977584 SUSE bug 977616 SUSE bug 978492 SUSE bug 990369 SUSE bug 990370 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. Important CVE-2016-2108 at SUSE CVE-2016-2108 at NVD SUSE bug 1001502 SUSE bug 1004499 SUSE bug 1005878 SUSE bug 1148697 SUSE bug 977584 SUSE bug 977617 SUSE bug 978492 SUSE bug 989345 SUSE bug 996067 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. Moderate CVE-2016-2109 at SUSE CVE-2016-2109 at NVD SUSE bug 1015243 SUSE bug 976942 SUSE bug 977584 SUSE bug 978492 SUSE bug 990369 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security. Moderate CVE-2016-2110 at SUSE CVE-2016-2110 at NVD SUSE bug 1009711 SUSE bug 973031 SUSE bug 973033 SUSE bug 973036 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Moderate CVE-2016-2111 at SUSE CVE-2016-2111 at NVD SUSE bug 973032 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Moderate CVE-2016-2112 at SUSE CVE-2016-2112 at NVD SUSE bug 973031 SUSE bug 973033 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate. Moderate CVE-2016-2113 at SUSE CVE-2016-2113 at NVD SUSE bug 973031 SUSE bug 973033 SUSE bug 973034 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream. Moderate CVE-2016-2114 at SUSE CVE-2016-2114 at NVD SUSE bug 973035 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Moderate CVE-2016-2115 at SUSE CVE-2016-2115 at NVD SUSE bug 973036 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Moderate CVE-2016-2116 at SUSE CVE-2016-2116 at NVD SUSE bug 1178702 SUSE bug 968373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. Moderate CVE-2016-2117 at SUSE CVE-2016-2117 at NVD SUSE bug 1027179 SUSE bug 968697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK." Moderate CVE-2016-2118 at SUSE CVE-2016-2118 at NVD SUSE bug 971965 SUSE bug 975276 SUSE bug 977416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag. Moderate CVE-2016-2119 at SUSE CVE-2016-2119 at NVD SUSE bug 986869 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. Moderate CVE-2016-2124 at SUSE CVE-2016-2124 at NVD SUSE bug 1014440 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. Low CVE-2016-2125 at SUSE CVE-2016-2125 at NVD SUSE bug 1014441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. Low CVE-2016-2126 at SUSE CVE-2016-2126 at NVD SUSE bug 1014442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h. Important CVE-2016-2143 at SUSE CVE-2016-2143 at NVD SUSE bug 1115893 SUSE bug 970504 SUSE bug 993872 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261. Important CVE-2016-2150 at SUSE CVE-2016-2150 at NVD SUSE bug 982385 SUSE bug 982386 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests. Moderate CVE-2016-2161 at SUSE CVE-2016-2161 at NVD SUSE bug 1016714 SUSE bug 1033513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. Important CVE-2016-2177 at SUSE CVE-2016-2177 at NVD SUSE bug 982575 SUSE bug 999075 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. Moderate CVE-2016-2178 at SUSE CVE-2016-2178 at NVD SUSE bug 1004104 SUSE bug 983249 SUSE bug 983519 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. Moderate CVE-2016-2179 at SUSE CVE-2016-2179 at NVD SUSE bug 1004104 SUSE bug 994844 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command. Low CVE-2016-2180 at SUSE CVE-2016-2180 at NVD SUSE bug 1003811 SUSE bug 990419 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. Moderate CVE-2016-2181 at SUSE CVE-2016-2181 at NVD SUSE bug 1004104 SUSE bug 994749 SUSE bug 994844 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. Moderate CVE-2016-2182 at SUSE CVE-2016-2182 at NVD SUSE bug 1004104 SUSE bug 993819 SUSE bug 994844 SUSE bug 995959 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. Moderate CVE-2016-2183 at SUSE CVE-2016-2183 at NVD SUSE bug 1001912 SUSE bug 1024218 SUSE bug 1027038 SUSE bug 1034689 SUSE bug 1056614 SUSE bug 1171693 SUSE bug 994844 SUSE bug 995359 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow. Moderate CVE-2016-2315 at SUSE CVE-2016-2315 at NVD SUSE bug 971328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow. Moderate CVE-2016-2324 at SUSE CVE-2016-2324 at NVD SUSE bug 971328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. Moderate CVE-2016-2384 at SUSE CVE-2016-2384 at NVD SUSE bug 1020452 SUSE bug 966693 SUSE bug 967773 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value. Low CVE-2016-2518 at SUSE CVE-2016-2518 at NVD SUSE bug 977446 SUSE bug 977457 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. Important CVE-2016-2569 at SUSE CVE-2016-2569 at NVD SUSE bug 968392 SUSE bug 968393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. Important CVE-2016-2570 at SUSE CVE-2016-2570 at NVD SUSE bug 968392 SUSE bug 968393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. Important CVE-2016-2571 at SUSE CVE-2016-2571 at NVD SUSE bug 968394 SUSE bug 968395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. Important CVE-2016-2572 at SUSE CVE-2016-2572 at NVD SUSE bug 968394 SUSE bug 968395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. Moderate CVE-2016-2774 at SUSE CVE-2016-2774 at NVD SUSE bug 969820 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. Important CVE-2016-2776 at SUSE CVE-2016-2776 at NVD SUSE bug 1000362 SUSE bug 1001595 SUSE bug 1001597 SUSE bug 1007829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. Important CVE-2016-2790 at SUSE CVE-2016-2790 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. Important CVE-2016-2791 at SUSE CVE-2016-2791 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800. Important CVE-2016-2792 at SUSE CVE-2016-2792 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. Important CVE-2016-2793 at SUSE CVE-2016-2793 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. Critical CVE-2016-2794 at SUSE CVE-2016-2794 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. Important CVE-2016-2795 at SUSE CVE-2016-2795 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font. Important CVE-2016-2796 at SUSE CVE-2016-2796 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801. Important CVE-2016-2797 at SUSE CVE-2016-2797 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. Important CVE-2016-2798 at SUSE CVE-2016-2798 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font. Critical CVE-2016-2799 at SUSE CVE-2016-2799 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792. Important CVE-2016-2800 at SUSE CVE-2016-2800 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797. Important CVE-2016-2801 at SUSE CVE-2016-2801 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font. Important CVE-2016-2802 at SUSE CVE-2016-2802 at NVD SUSE bug 969894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2016-2805 at SUSE CVE-2016-2805 at NVD SUSE bug 977333 SUSE bug 977374 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2016-2806 at SUSE CVE-2016-2806 at NVD SUSE bug 977375 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2016-2807 at SUSE CVE-2016-2807 at NVD SUSE bug 977333 SUSE bug 977376 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site. Moderate CVE-2016-2808 at SUSE CVE-2016-2808 at NVD SUSE bug 977333 SUSE bug 977386 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table. Moderate CVE-2016-2814 at SUSE CVE-2016-2814 at NVD SUSE bug 977333 SUSE bug 977381 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Moderate CVE-2016-2818 at SUSE CVE-2016-2818 at NVD SUSE bug 983549 SUSE bug 983638 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element. Moderate CVE-2016-2819 at SUSE CVE-2016-2819 at NVD SUSE bug 983549 SUSE bug 983655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor. Moderate CVE-2016-2821 at SUSE CVE-2016-2821 at NVD SUSE bug 983549 SUSE bug 983653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu. Moderate CVE-2016-2822 at SUSE CVE-2016-2822 at NVD SUSE bug 983549 SUSE bug 983652 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool. Moderate CVE-2016-2828 at SUSE CVE-2016-2828 at NVD SUSE bug 983549 SUSE bug 983646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses. Moderate CVE-2016-2830 at SUSE CVE-2016-2830 at NVD SUSE bug 983922 SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site. Moderate CVE-2016-2831 at SUSE CVE-2016-2831 at NVD SUSE bug 983549 SUSE bug 983632 SUSE bug 983643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Moderate CVE-2016-2834 at SUSE CVE-2016-2834 at NVD SUSE bug 983549 SUSE bug 983639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. Moderate CVE-2016-2836 at SUSE CVE-2016-2836 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass. Moderate CVE-2016-2837 at SUSE CVE-2016-2837 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document. Moderate CVE-2016-2838 at SUSE CVE-2016-2838 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799. Critical CVE-2016-2842 at SUSE CVE-2016-2842 at NVD SUSE bug 969517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes. Moderate CVE-2016-2847 at SUSE CVE-2016-2847 at NVD SUSE bug 1020452 SUSE bug 970948 SUSE bug 974646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet. Low CVE-2016-2857 at SUSE CVE-2016-2857 at NVD SUSE bug 970037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository. Moderate CVE-2016-3068 at SUSE CVE-2016-3068 at NVD SUSE bug 973175 SUSE bug 973177 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. Moderate CVE-2016-3069 at SUSE CVE-2016-3069 at NVD SUSE bug 973175 SUSE bug 973176 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. Low CVE-2016-3070 at SUSE CVE-2016-3070 at NVD SUSE bug 979215 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name. Low CVE-2016-3075 at SUSE CVE-2016-3075 at NVD SUSE bug 1123874 SUSE bug 973164 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. Important CVE-2016-3092 at SUSE CVE-2016-3092 at NVD SUSE bug 1068865 SUSE bug 986359 SUSE bug 988489 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled. Moderate CVE-2016-3099 at SUSE CVE-2016-3099 at NVD SUSE bug 973996 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. Moderate CVE-2016-3115 at SUSE CVE-2016-3115 at NVD SUSE bug 1005738 SUSE bug 1010950 SUSE bug 1059233 SUSE bug 1138392 SUSE bug 970632 SUSE bug 992296 SUSE bug 992991 SUSE bug 996040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. Moderate CVE-2016-3119 at SUSE CVE-2016-3119 at NVD SUSE bug 971942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. Low CVE-2016-3120 at SUSE CVE-2016-3120 at NVD SUSE bug 991088 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. Moderate CVE-2016-3134 at SUSE CVE-2016-3134 at NVD SUSE bug 1020452 SUSE bug 1052256 SUSE bug 1115893 SUSE bug 971126 SUSE bug 971793 SUSE bug 986362 SUSE bug 986365 SUSE bug 986377 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. Low CVE-2016-3156 at SUSE CVE-2016-3156 at NVD SUSE bug 1020452 SUSE bug 971360 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file. Moderate CVE-2016-3186 at SUSE CVE-2016-3186 at NVD SUSE bug 973340 SUSE bug 983268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. Low CVE-2016-3191 at SUSE CVE-2016-3191 at NVD SUSE bug 971741 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. Important CVE-2016-3425 at SUSE CVE-2016-3425 at NVD SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE. Important CVE-2016-3426 at SUSE CVE-2016-3426 at NVD SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Important CVE-2016-3427 at SUSE CVE-2016-3427 at NVD SUSE bug 1011805 SUSE bug 976340 SUSE bug 979252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. Moderate CVE-2016-3452 at SUSE CVE-2016-3452 at NVD SUSE bug 989910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA. Low CVE-2016-3458 at SUSE CVE-2016-3458 at NVD SUSE bug 989732 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. Moderate CVE-2016-3477 at SUSE CVE-2016-3477 at NVD SUSE bug 989913 SUSE bug 991616 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer. Moderate CVE-2016-3492 at SUSE CVE-2016-3492 at NVD SUSE bug 1005555 SUSE bug 1008318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508. Moderate CVE-2016-3500 at SUSE CVE-2016-3500 at NVD SUSE bug 989730 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500. Moderate CVE-2016-3508 at SUSE CVE-2016-3508 at NVD SUSE bug 989731 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: Types. Important CVE-2016-3521 at SUSE CVE-2016-3521 at NVD SUSE bug 989919 SUSE bug 991616 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot. Low CVE-2016-3550 at SUSE CVE-2016-3550 at NVD SUSE bug 989733 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. Important CVE-2016-3587 at SUSE CVE-2016-3587 at NVD SUSE bug 989721 SUSE bug 998845 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610. Important CVE-2016-3598 at SUSE CVE-2016-3598 at NVD SUSE bug 1009280 SUSE bug 989723 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. Important CVE-2016-3606 at SUSE CVE-2016-3606 at NVD SUSE bug 989722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598. Important CVE-2016-3610 at SUSE CVE-2016-3610 at NVD SUSE bug 989725 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: DML. Moderate CVE-2016-3615 at SUSE CVE-2016-3615 at NVD SUSE bug 989922 SUSE bug 991616 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file. Moderate CVE-2016-3616 at SUSE CVE-2016-3616 at NVD SUSE bug 1160884 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. Moderate CVE-2016-3627 at SUSE CVE-2016-3627 at NVD SUSE bug 1026099 SUSE bug 1026101 SUSE bug 1123919 SUSE bug 972335 SUSE bug 975947 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image. Low CVE-2016-3632 at SUSE CVE-2016-3632 at NVD SUSE bug 1007276 SUSE bug 974621 SUSE bug 983436 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits. Low CVE-2016-3672 at SUSE CVE-2016-3672 at NVD SUSE bug 974308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network. Moderate CVE-2016-3698 at SUSE CVE-2016-3698 at NVD SUSE bug 979645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. Important CVE-2016-3699 at SUSE CVE-2016-3699 at NVD SUSE bug 1001153 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. Important CVE-2016-3705 at SUSE CVE-2016-3705 at NVD SUSE bug 1017497 SUSE bug 1123919 SUSE bug 975947 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue. Moderate CVE-2016-3710 at SUSE CVE-2016-3710 at NVD SUSE bug 978158 SUSE bug 978164 SUSE bug 978167 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. Low CVE-2016-3712 at SUSE CVE-2016-3712 at NVD SUSE bug 978160 SUSE bug 978164 SUSE bug 978167 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick." Important CVE-2016-3714 at SUSE CVE-2016-3714 at NVD SUSE bug 1000484 SUSE bug 1057163 SUSE bug 1105592 SUSE bug 978061 SUSE bug 980401 SUSE bug 982178 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Moderate CVE-2016-3715 at SUSE CVE-2016-3715 at NVD SUSE bug 1000484 SUSE bug 1057163 SUSE bug 1105592 SUSE bug 978061 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. Moderate CVE-2016-3716 at SUSE CVE-2016-3716 at NVD SUSE bug 1000484 SUSE bug 1057163 SUSE bug 1105592 SUSE bug 978061 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. Moderate CVE-2016-3717 at SUSE CVE-2016-3717 at NVD SUSE bug 1000484 SUSE bug 1057163 SUSE bug 1105592 SUSE bug 978061 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Moderate CVE-2016-3718 at SUSE CVE-2016-3718 at NVD SUSE bug 1000484 SUSE bug 1057163 SUSE bug 1105592 SUSE bug 978061 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. Moderate CVE-2016-3841 at SUSE CVE-2016-3841 at NVD SUSE bug 1052256 SUSE bug 1115893 SUSE bug 992566 SUSE bug 992569 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write. Low CVE-2016-3945 at SUSE CVE-2016-3945 at NVD SUSE bug 974614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. Important CVE-2016-3948 at SUSE CVE-2016-3948 at NVD SUSE bug 973783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp. Low CVE-2016-3990 at SUSE CVE-2016-3990 at NVD SUSE bug 975069 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles. Low CVE-2016-3991 at SUSE CVE-2016-3991 at NVD SUSE bug 975070 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR). Low CVE-2016-4020 at SUSE CVE-2016-4020 at NVD SUSE bug 975700 SUSE bug 975907 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. Important CVE-2016-4051 at SUSE CVE-2016-4051 at NVD SUSE bug 976553 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. Important CVE-2016-4052 at SUSE CVE-2016-4052 at NVD SUSE bug 976556 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. Important CVE-2016-4053 at SUSE CVE-2016-4053 at NVD SUSE bug 976556 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. Important CVE-2016-4054 at SUSE CVE-2016-4054 at NVD SUSE bug 976556 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow. Moderate CVE-2016-4300 at SUSE CVE-2016-4300 at NVD SUSE bug 985832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary. Moderate CVE-2016-4302 at SUSE CVE-2016-4302 at NVD SUSE bug 985835 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function. Moderate CVE-2016-4444 at SUSE CVE-2016-4444 at NVD SUSE bug 983452 SUSE bug 984780 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function. Moderate CVE-2016-4446 at SUSE CVE-2016-4446 at NVD SUSE bug 984780 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName. Moderate CVE-2016-4447 at SUSE CVE-2016-4447 at NVD SUSE bug 1123919 SUSE bug 981548 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors. Moderate CVE-2016-4448 at SUSE CVE-2016-4448 at NVD SUSE bug 1010299 SUSE bug 1123919 SUSE bug 981549 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors. Moderate CVE-2016-4449 at SUSE CVE-2016-4449 at NVD SUSE bug 1123919 SUSE bug 981550 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD. Moderate CVE-2016-4463 at SUSE CVE-2016-4463 at NVD SUSE bug 985860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. Moderate CVE-2016-4470 at SUSE CVE-2016-4470 at NVD SUSE bug 1020452 SUSE bug 984755 SUSE bug 984764 SUSE bug 991651 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. Moderate CVE-2016-4553 at SUSE CVE-2016-4553 at NVD SUSE bug 979009 SUSE bug 990451 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. Moderate CVE-2016-4554 at SUSE CVE-2016-4554 at NVD SUSE bug 979010 SUSE bug 990451 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. Moderate CVE-2016-4555 at SUSE CVE-2016-4555 at NVD SUSE bug 979008 SUSE bug 979011 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. Moderate CVE-2016-4556 at SUSE CVE-2016-4556 at NVD SUSE bug 979008 SUSE bug 979011 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. Moderate CVE-2016-4565 at SUSE CVE-2016-4565 at NVD SUSE bug 1020452 SUSE bug 979548 SUSE bug 980363 SUSE bug 980883 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. Low CVE-2016-4569 at SUSE CVE-2016-4569 at NVD SUSE bug 1020452 SUSE bug 979213 SUSE bug 979879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions. Low CVE-2016-4578 at SUSE CVE-2016-4578 at NVD SUSE bug 1020452 SUSE bug 1052256 SUSE bug 979879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls. Moderate CVE-2016-4581 at SUSE CVE-2016-4581 at NVD SUSE bug 979913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. Moderate CVE-2016-4658 at SUSE CVE-2016-4658 at NVD SUSE bug 1005544 SUSE bug 1014873 SUSE bug 1069433 SUSE bug 1078813 SUSE bug 1123919 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls. Moderate CVE-2016-4794 at SUSE CVE-2016-4794 at NVD SUSE bug 980265 SUSE bug 981517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink. Low CVE-2016-4809 at SUSE CVE-2016-4809 at NVD SUSE bug 984990 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem. Moderate CVE-2016-4913 at SUSE CVE-2016-4913 at NVD SUSE bug 1115893 SUSE bug 870618 SUSE bug 980725 SUSE bug 985132 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. Moderate CVE-2016-4971 at SUSE CVE-2016-4971 at NVD SUSE bug 1023231 SUSE bug 984060 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445. Moderate CVE-2016-4989 at SUSE CVE-2016-4989 at NVD SUSE bug 984780 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects. Important CVE-2016-4992 at SUSE CVE-2016-4992 at NVD SUSE bug 991201 SUSE bug 997256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file. Moderate CVE-2016-4994 at SUSE CVE-2016-4994 at NVD SUSE bug 986021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement. Important CVE-2016-4997 at SUSE CVE-2016-4997 at NVD SUSE bug 1020452 SUSE bug 986362 SUSE bug 986365 SUSE bug 986377 SUSE bug 991651 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. Critical CVE-2016-5003 at SUSE CVE-2016-5003 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. Moderate CVE-2016-5008 at SUSE CVE-2016-5008 at NVD SUSE bug 987527 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset. Low CVE-2016-5011 at SUSE CVE-2016-5011 at NVD SUSE bug 988361 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. Low CVE-2016-5018 at SUSE CVE-2016-5018 at NVD SUSE bug 1007855 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename. Moderate CVE-2016-5118 at SUSE CVE-2016-5118 at NVD SUSE bug 1000484 SUSE bug 982178 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call. Low CVE-2016-5126 at SUSE CVE-2016-5126 at NVD SUSE bug 982285 SUSE bug 982286 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Moderate CVE-2016-5131 at SUSE CVE-2016-5131 at NVD SUSE bug 1014873 SUSE bug 1069433 SUSE bug 1078813 SUSE bug 1123919 SUSE bug 989901 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. Critical CVE-2016-5139 at SUSE CVE-2016-5139 at NVD SUSE bug 992305 SUSE bug 992311 SUSE bug 992325 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. Important CVE-2016-5158 at SUSE CVE-2016-5158 at NVD SUSE bug 996648 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c. Important CVE-2016-5159 at SUSE CVE-2016-5159 at NVD SUSE bug 996648 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." Important CVE-2016-5195 at SUSE CVE-2016-5195 at NVD SUSE bug 1004418 SUSE bug 1004419 SUSE bug 1004436 SUSE bug 1006323 SUSE bug 1006695 SUSE bug 1007291 SUSE bug 1008110 SUSE bug 1030118 SUSE bug 1046453 SUSE bug 1069496 SUSE bug 1149725 SUSE bug 870618 SUSE bug 986445 SUSE bug 998689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors. Moderate CVE-2016-5239 at SUSE CVE-2016-5239 at NVD SUSE bug 982969 SUSE bug 983539 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file. Moderate CVE-2016-5240 at SUSE CVE-2016-5240 at NVD SUSE bug 983309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls. Moderate CVE-2016-5250 at SUSE CVE-2016-5250 at NVD SUSE bug 991809 SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations. Moderate CVE-2016-5252 at SUSE CVE-2016-5252 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items. Moderate CVE-2016-5254 at SUSE CVE-2016-5254 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Important CVE-2016-5257 at SUSE CVE-2016-5257 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session. Moderate CVE-2016-5258 at SUSE CVE-2016-5258 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop. Moderate CVE-2016-5259 at SUSE CVE-2016-5259 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering. Moderate CVE-2016-5261 at SUSE CVE-2016-5261 at NVD SUSE bug 991809 SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. Moderate CVE-2016-5262 at SUSE CVE-2016-5262 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion." Moderate CVE-2016-5263 at SUSE CVE-2016-5263 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. Moderate CVE-2016-5264 at SUSE CVE-2016-5264 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. Moderate CVE-2016-5265 at SUSE CVE-2016-5265 at NVD SUSE bug 991809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion. Important CVE-2016-5270 at SUSE CVE-2016-5270 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. Important CVE-2016-5272 at SUSE CVE-2016-5272 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation. Important CVE-2016-5274 at SUSE CVE-2016-5274 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute. Important CVE-2016-5276 at SUSE CVE-2016-5276 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation. Important CVE-2016-5277 at SUSE CVE-2016-5277 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image. Important CVE-2016-5278 at SUSE CVE-2016-5278 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text. Important CVE-2016-5280 at SUSE CVE-2016-5280 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document. Important CVE-2016-5281 at SUSE CVE-2016-5281 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority. Important CVE-2016-5284 at SUSE CVE-2016-5284 at NVD SUSE bug 999701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service. Moderate CVE-2016-5285 at SUSE CVE-2016-5285 at NVD SUSE bug 1010517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Important CVE-2016-5290 at SUSE CVE-2016-5290 at NVD SUSE bug 1009026 SUSE bug 1010427 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Moderate CVE-2016-5291 at SUSE CVE-2016-5291 at NVD SUSE bug 1009026 SUSE bug 1010410 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Important CVE-2016-5296 at SUSE CVE-2016-5296 at NVD SUSE bug 1009026 SUSE bug 1010395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Moderate CVE-2016-5297 at SUSE CVE-2016-5297 at NVD SUSE bug 1009026 SUSE bug 1010401 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5314. Reason: This candidate is a reservation duplicate of CVE-2016-5314. Notes: All CVE users should reference CVE-2016-5314 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Moderate CVE-2016-5320 at SUSE CVE-2016-5320 at NVD SUSE bug 1007284 SUSE bug 974621 SUSE bug 984808 SUSE bug 987351 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each. Moderate CVE-2016-5361 at SUSE CVE-2016-5361 at NVD SUSE bug 984628 SUSE bug 984630 SUSE bug 985012 SUSE bug 985016 SUSE bug 985017 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file. Low CVE-2016-5384 at SUSE CVE-2016-5384 at NVD SUSE bug 1123116 SUSE bug 992534 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. Moderate CVE-2016-5385 at SUSE CVE-2016-5385 at NVD SUSE bug 988484 SUSE bug 988486 SUSE bug 988487 SUSE bug 988488 SUSE bug 988489 SUSE bug 988491 SUSE bug 988492 SUSE bug 989125 SUSE bug 989174 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Moderate CVE-2016-5386 at SUSE CVE-2016-5386 at NVD SUSE bug 988484 SUSE bug 988486 SUSE bug 988487 SUSE bug 988488 SUSE bug 988489 SUSE bug 988491 SUSE bug 988492 SUSE bug 989125 SUSE bug 989174 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability. Moderate CVE-2016-5387 at SUSE CVE-2016-5387 at NVD SUSE bug 988484 SUSE bug 988486 SUSE bug 988487 SUSE bug 988488 SUSE bug 988489 SUSE bug 988491 SUSE bug 988492 SUSE bug 989125 SUSE bug 989174 SUSE bug 989684 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability. Moderate CVE-2016-5388 at SUSE CVE-2016-5388 at NVD SUSE bug 988484 SUSE bug 988486 SUSE bug 988487 SUSE bug 988488 SUSE bug 988489 SUSE bug 988491 SUSE bug 988492 SUSE bug 989125 SUSE bug 989174 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive. Moderate CVE-2016-5399 at SUSE CVE-2016-5399 at NVD SUSE bug 991430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. Low CVE-2016-5403 at SUSE CVE-2016-5403 at NVD SUSE bug 990923 SUSE bug 991080 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. Moderate CVE-2016-5404 at SUSE CVE-2016-5404 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords. Low CVE-2016-5405 at SUSE CVE-2016-5405 at NVD SUSE bug 1007004 SUSE bug 1076530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method. Low CVE-2016-5410 at SUSE CVE-2016-5410 at NVD SUSE bug 992772 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction. Moderate CVE-2016-5412 at SUSE CVE-2016-5412 at NVD SUSE bug 1013013 SUSE bug 991065 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions. Moderate CVE-2016-5416 at SUSE CVE-2016-5416 at NVD SUSE bug 991201 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. Moderate CVE-2016-5418 at SUSE CVE-2016-5418 at NVD SUSE bug 998677 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. Moderate CVE-2016-5419 at SUSE CVE-2016-5419 at NVD SUSE bug 1033413 SUSE bug 1033442 SUSE bug 991389 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. Moderate CVE-2016-5420 at SUSE CVE-2016-5420 at NVD SUSE bug 991390 SUSE bug 997420 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types. Moderate CVE-2016-5423 at SUSE CVE-2016-5423 at NVD SUSE bug 1041981 SUSE bug 1042497 SUSE bug 1052683 SUSE bug 993454 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation. Moderate CVE-2016-5424 at SUSE CVE-2016-5424 at NVD SUSE bug 1041981 SUSE bug 1042497 SUSE bug 1052683 SUSE bug 993453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group. Important CVE-2016-5425 at SUSE CVE-2016-5425 at NVD SUSE bug 1003877 SUSE bug 1172405 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR. Moderate CVE-2016-5440 at SUSE CVE-2016-5440 at NVD SUSE bug 989926 SUSE bug 991616 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection. Moderate CVE-2016-5444 at SUSE CVE-2016-5444 at NVD SUSE bug 989930 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries. Moderate CVE-2016-5542 at SUSE CVE-2016-5542 at NVD SUSE bug 1005522 SUSE bug 1009280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts). Important CVE-2016-5546 at SUSE CVE-2016-5546 at NVD SUSE bug 1020905 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.3 (Availability impacts). Moderate CVE-2016-5547 at SUSE CVE-2016-5547 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 6.5 (Confidentiality impacts). Important CVE-2016-5548 at SUSE CVE-2016-5548 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.3 (Integrity impacts). Moderate CVE-2016-5552 at SUSE CVE-2016-5552 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX. Moderate CVE-2016-5554 at SUSE CVE-2016-5554 at NVD SUSE bug 1005523 SUSE bug 1009280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582. Important CVE-2016-5573 at SUSE CVE-2016-5573 at NVD SUSE bug 1005526 SUSE bug 1009280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573. Important CVE-2016-5582 at SUSE CVE-2016-5582 at NVD SUSE bug 1005527 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking. Moderate CVE-2016-5597 at SUSE CVE-2016-5597 at NVD SUSE bug 1005528 SUSE bug 1009280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. Moderate CVE-2016-5612 at SUSE CVE-2016-5612 at NVD SUSE bug 1005561 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML. Moderate CVE-2016-5624 at SUSE CVE-2016-5624 at NVD SUSE bug 1005564 SUSE bug 1008318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS. Moderate CVE-2016-5626 at SUSE CVE-2016-5626 at NVD SUSE bug 1005566 SUSE bug 1008318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated. Moderate CVE-2016-5629 at SUSE CVE-2016-5629 at NVD SUSE bug 1005569 SUSE bug 1008318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow. Moderate CVE-2016-5636 at SUSE CVE-2016-5636 at NVD SUSE bug 1065451 SUSE bug 1106262 SUSE bug 985177 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means. Moderate CVE-2016-5652 at SUSE CVE-2016-5652 at NVD SUSE bug 1007280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image. Moderate CVE-2016-5766 at SUSE CVE-2016-5766 at NVD SUSE bug 986386 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions. Moderate CVE-2016-5767 at SUSE CVE-2016-5767 at NVD SUSE bug 986393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception. Low CVE-2016-5768 at SUSE CVE-2016-5768 at NVD SUSE bug 986246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. Moderate CVE-2016-5824 at SUSE CVE-2016-5824 at NVD SUSE bug 1015964 SUSE bug 1122983 SUSE bug 986631 SUSE bug 986639 SUSE bug 986642 SUSE bug 986658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call. Moderate CVE-2016-5828 at SUSE CVE-2016-5828 at NVD SUSE bug 986569 SUSE bug 991065 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. Moderate CVE-2016-5829 at SUSE CVE-2016-5829 at NVD SUSE bug 1053919 SUSE bug 1054127 SUSE bug 1115893 SUSE bug 986572 SUSE bug 986573 SUSE bug 991651 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. Moderate CVE-2016-5844 at SUSE CVE-2016-5844 at NVD SUSE bug 986566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability. Moderate CVE-2016-6136 at SUSE CVE-2016-6136 at NVD SUSE bug 988153 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c. Moderate CVE-2016-6198 at SUSE CVE-2016-6198 at NVD SUSE bug 988708 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided. Moderate CVE-2016-6210 at SUSE CVE-2016-6210 at NVD SUSE bug 1001712 SUSE bug 1010950 SUSE bug 1105010 SUSE bug 1138392 SUSE bug 989363 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. Low CVE-2016-6213 at SUSE CVE-2016-6213 at NVD SUSE bug 988964 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow. Low CVE-2016-6250 at SUSE CVE-2016-6250 at NVD SUSE bug 989980 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. Moderate CVE-2016-6302 at SUSE CVE-2016-6302 at NVD SUSE bug 1004104 SUSE bug 994844 SUSE bug 995324 SUSE bug 999665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. Moderate CVE-2016-6304 at SUSE CVE-2016-6304 at NVD SUSE bug 1001706 SUSE bug 1003811 SUSE bug 1004104 SUSE bug 1005579 SUSE bug 1021375 SUSE bug 999665 SUSE bug 999666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. Low CVE-2016-6306 at SUSE CVE-2016-6306 at NVD SUSE bug 1004104 SUSE bug 999665 SUSE bug 999668 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. Moderate CVE-2016-6313 at SUSE CVE-2016-6313 at NVD SUSE bug 1123792 SUSE bug 994157 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group. Important CVE-2016-6325 at SUSE CVE-2016-6325 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation. Moderate CVE-2016-6327 at SUSE CVE-2016-6327 at NVD SUSE bug 994748 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. Moderate CVE-2016-6480 at SUSE CVE-2016-6480 at NVD SUSE bug 1004418 SUSE bug 991608 SUSE bug 991667 SUSE bug 992568 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack. Moderate CVE-2016-6489 at SUSE CVE-2016-6489 at NVD SUSE bug 991464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string. Moderate CVE-2016-6515 at SUSE CVE-2016-6515 at NVD SUSE bug 1010950 SUSE bug 1115893 SUSE bug 992533 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15. Important CVE-2016-6662 at SUSE CVE-2016-6662 at NVD SUSE bug 1001367 SUSE bug 1005580 SUSE bug 1020873 SUSE bug 1020884 SUSE bug 1021755 SUSE bug 998309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table. Moderate CVE-2016-6663 at SUSE CVE-2016-6663 at NVD SUSE bug 1001367 SUSE bug 1008253 SUSE bug 1008318 SUSE bug 1021755 SUSE bug 998309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files. Important CVE-2016-6664 at SUSE CVE-2016-6664 at NVD SUSE bug 1008253 SUSE bug 1020868 SUSE bug 1020873 SUSE bug 998309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. Low CVE-2016-6794 at SUSE CVE-2016-6794 at NVD SUSE bug 1007857 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. Low CVE-2016-6796 at SUSE CVE-2016-6796 at NVD SUSE bug 1007858 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. Low CVE-2016-6797 at SUSE CVE-2016-6797 at NVD SUSE bug 1007853 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability. Critical CVE-2016-6814 at SUSE CVE-2016-6814 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. Moderate CVE-2016-6816 at SUSE CVE-2016-6816 at NVD SUSE bug 1011812 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option. Moderate CVE-2016-6828 at SUSE CVE-2016-6828 at NVD SUSE bug 1052256 SUSE bug 994296 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account. Low CVE-2016-6893 at SUSE CVE-2016-6893 at NVD SUSE bug 995352 SUSE bug 997205 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on. Important CVE-2016-7030 at SUSE CVE-2016-7030 at NVD SUSE bug 1015556 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function. Moderate CVE-2016-7032 at SUSE CVE-2016-7032 at NVD SUSE bug 1007501 SUSE bug 1007766 SUSE bug 1011975 SUSE bug 1011976 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. Moderate CVE-2016-7035 at SUSE CVE-2016-7035 at NVD SUSE bug 1007433 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666. Important CVE-2016-7039 at SUSE CVE-2016-7039 at NVD SUSE bug 1001486 SUSE bug 1001487 SUSE bug 1003964 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file. Moderate CVE-2016-7042 at SUSE CVE-2016-7042 at NVD SUSE bug 1004517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code. Critical CVE-2016-7050 at SUSE CVE-2016-7050 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges. Moderate CVE-2016-7076 at SUSE CVE-2016-7076 at NVD SUSE bug 1007501 SUSE bug 1011975 SUSE bug 1011976 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo. Moderate CVE-2016-7091 at SUSE CVE-2016-7091 at NVD SUSE bug 995726 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. Low CVE-2016-7097 at SUSE CVE-2016-7097 at NVD SUSE bug 1021258 SUSE bug 1052256 SUSE bug 870618 SUSE bug 995968 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing. Moderate CVE-2016-7117 at SUSE CVE-2016-7117 at NVD SUSE bug 1003077 SUSE bug 1003253 SUSE bug 1057478 SUSE bug 1071943 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. Low CVE-2016-7141 at SUSE CVE-2016-7141 at NVD SUSE bug 991390 SUSE bug 997420 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write. Critical CVE-2016-7163 at SUSE CVE-2016-7163 at NVD SUSE bug 1007739 SUSE bug 1007744 SUSE bug 997857 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file. Moderate CVE-2016-7166 at SUSE CVE-2016-7166 at NVD SUSE bug 998115 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow. Moderate CVE-2016-7167 at SUSE CVE-2016-7167 at NVD SUSE bug 998760 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address. Low CVE-2016-7426 at SUSE CVE-2016-7426 at NVD SUSE bug 1011406 SUSE bug 1011421 SUSE bug 1012330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use. Low CVE-2016-7429 at SUSE CVE-2016-7429 at NVD SUSE bug 1011404 SUSE bug 1011421 SUSE bug 1012330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion." Low CVE-2016-7433 at SUSE CVE-2016-7433 at NVD SUSE bug 1011411 SUSE bug 1011421 SUSE bug 1012330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc. Low CVE-2016-7444 at SUSE CVE-2016-7444 at NVD SUSE bug 999646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. Moderate CVE-2016-7543 at SUSE CVE-2016-7543 at NVD SUSE bug 1001299 SUSE bug 1159416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. Moderate CVE-2016-7545 at SUSE CVE-2016-7545 at NVD SUSE bug 1000998 SUSE bug 968375 SUSE bug 968674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket. Moderate CVE-2016-7795 at SUSE CVE-2016-7795 at NVD SUSE bug 1001765 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection. Moderate CVE-2016-7797 at SUSE CVE-2016-7797 at NVD SUSE bug 1002767 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed. Important CVE-2016-7910 at SUSE CVE-2016-7910 at NVD SUSE bug 1010716 SUSE bug 1115893 SUSE bug 1196722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Important CVE-2016-7913 at SUSE CVE-2016-7913 at NVD SUSE bug 1010478 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print(). Moderate CVE-2016-7922 at SUSE CVE-2016-7922 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print(). Moderate CVE-2016-7923 at SUSE CVE-2016-7923 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oam_print(). Moderate CVE-2016-7924 at SUSE CVE-2016-7924 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print(). Moderate CVE-2016-7925 at SUSE CVE-2016-7925 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print(). Moderate CVE-2016-7926 at SUSE CVE-2016-7926 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print(). Moderate CVE-2016-7927 at SUSE CVE-2016-7927 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcomp_print(). Moderate CVE-2016-7928 at SUSE CVE-2016-7928 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header(). Moderate CVE-2016-7929 at SUSE CVE-2016-7929 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print(). Moderate CVE-2016-7930 at SUSE CVE-2016-7930 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print(). Moderate CVE-2016-7931 at SUSE CVE-2016-7931 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print-pim.c:pimv2_check_checksum(). Moderate CVE-2016-7932 at SUSE CVE-2016-7932 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppp_hdlc_if_print(). Moderate CVE-2016-7933 at SUSE CVE-2016-7933 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print(). Moderate CVE-2016-7934 at SUSE CVE-2016-7934 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print(). Moderate CVE-2016-7935 at SUSE CVE-2016-7935 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print(). Moderate CVE-2016-7936 at SUSE CVE-2016-7936 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print(). Moderate CVE-2016-7937 at SUSE CVE-2016-7937 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame(). Moderate CVE-2016-7938 at SUSE CVE-2016-7938 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions. Moderate CVE-2016-7939 at SUSE CVE-2016-7939 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions. Moderate CVE-2016-7940 at SUSE CVE-2016-7940 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions. Moderate CVE-2016-7973 at SUSE CVE-2016-7973 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions. Moderate CVE-2016-7974 at SUSE CVE-2016-7974 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print(). Moderate CVE-2016-7975 at SUSE CVE-2016-7975 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document. Important CVE-2016-7977 at SUSE CVE-2016-7977 at NVD SUSE bug 1001951 SUSE bug 1004237 SUSE bug 1095610 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice. Important CVE-2016-7978 at SUSE CVE-2016-7978 at NVD SUSE bug 1001951 SUSE bug 1004237 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser. Important CVE-2016-7979 at SUSE CVE-2016-7979 at NVD SUSE bug 1001951 SUSE bug 1004237 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). Moderate CVE-2016-7983 at SUSE CVE-2016-7983 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print(). Moderate CVE-2016-7984 at SUSE CVE-2016-7984 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print(). Moderate CVE-2016-7985 at SUSE CVE-2016-7985 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions. Moderate CVE-2016-7986 at SUSE CVE-2016-7986 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print(). Moderate CVE-2016-7992 at SUSE CVE-2016-7992 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM). Moderate CVE-2016-7993 at SUSE CVE-2016-7993 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. Moderate CVE-2016-8283 at SUSE CVE-2016-8283 at NVD SUSE bug 1005582 SUSE bug 1008318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935. Moderate CVE-2016-8399 at SUSE CVE-2016-8399 at NVD SUSE bug 1014746 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print(). Moderate CVE-2016-8574 at SUSE CVE-2016-8574 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482. Moderate CVE-2016-8575 at SUSE CVE-2016-8575 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack. Moderate CVE-2016-8602 at SUSE CVE-2016-8602 at NVD SUSE bug 1001951 SUSE bug 1004237 SUSE bug 1036453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. Important CVE-2016-8610 at SUSE CVE-2016-8610 at NVD SUSE bug 1005878 SUSE bug 1005879 SUSE bug 1110018 SUSE bug 1120592 SUSE bug 1126909 SUSE bug 1148697 SUSE bug 982575 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction. Moderate CVE-2016-8630 at SUSE CVE-2016-8630 at NVD SUSE bug 1009222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets. Moderate CVE-2016-8633 at SUSE CVE-2016-8633 at NVD SUSE bug 1008833 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group. Moderate CVE-2016-8635 at SUSE CVE-2016-8635 at NVD SUSE bug 1015422 SUSE bug 1015547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability." Critical CVE-2016-8638 at SUSE CVE-2016-8638 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. Low CVE-2016-8645 at SUSE CVE-2016-8645 at NVD SUSE bug 1009969 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data. Moderate CVE-2016-8646 at SUSE CVE-2016-8646 at NVD SUSE bug 1010150 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent. Important CVE-2016-8650 at SUSE CVE-2016-8650 at NVD SUSE bug 1011820 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected. Important CVE-2016-8654 at SUSE CVE-2016-8654 at NVD SUSE bug 1012530 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. Moderate CVE-2016-8655 at SUSE CVE-2016-8655 at NVD SUSE bug 1012754 SUSE bug 1012759 SUSE bug 1013822 SUSE bug 1052365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command. Moderate CVE-2016-8690 at SUSE CVE-2016-8690 at NVD SUSE bug 1005084 SUSE bug 1007009 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command. Moderate CVE-2016-8691 at SUSE CVE-2016-8691 at NVD SUSE bug 1005090 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command. Moderate CVE-2016-8692 at SUSE CVE-2016-8692 at NVD SUSE bug 1005090 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. Moderate CVE-2016-8693 at SUSE CVE-2016-8693 at NVD SUSE bug 1005242 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. Moderate CVE-2016-8704 at SUSE CVE-2016-8704 at NVD SUSE bug 1007719 SUSE bug 1007866 SUSE bug 1007871 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. Critical CVE-2016-8705 at SUSE CVE-2016-8705 at NVD SUSE bug 1007866 SUSE bug 1007870 SUSE bug 1056865 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. Moderate CVE-2016-8706 at SUSE CVE-2016-8706 at NVD SUSE bug 1007866 SUSE bug 1007869 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. Moderate CVE-2016-8743 at SUSE CVE-2016-8743 at NVD SUSE bug 1016715 SUSE bug 1033513 SUSE bug 1086774 SUSE bug 1104826 SUSE bug 930944 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions. Moderate CVE-2016-8745 at SUSE CVE-2016-8745 at NVD SUSE bug 1015119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. Important CVE-2016-8864 at SUSE CVE-2016-8864 at NVD SUSE bug 1007829 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1020526 SUSE bug 1024130 SUSE bug 1033466 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. Moderate CVE-2016-8883 at SUSE CVE-2016-8883 at NVD SUSE bug 1006598 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690. Low CVE-2016-8884 at SUSE CVE-2016-8884 at NVD SUSE bug 1005084 SUSE bug 1007009 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. Low CVE-2016-8885 at SUSE CVE-2016-8885 at NVD SUSE bug 1005084 SUSE bug 1007009 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50. Moderate CVE-2016-9064 at SUSE CVE-2016-9064 at NVD SUSE bug 1009026 SUSE bug 1010402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Moderate CVE-2016-9066 at SUSE CVE-2016-9066 at NVD SUSE bug 1009026 SUSE bug 1010404 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1. Moderate CVE-2016-9079 at SUSE CVE-2016-9079 at NVD SUSE bug 1012964 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug." Low CVE-2016-9083 at SUSE CVE-2016-9083 at NVD SUSE bug 1007197 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file. Low CVE-2016-9084 at SUSE CVE-2016-9084 at NVD SUSE bug 1007197 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. Important CVE-2016-9131 at SUSE CVE-2016-9131 at NVD SUSE bug 1018699 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1033466 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets. Important CVE-2016-9147 at SUSE CVE-2016-9147 at NVD SUSE bug 1018699 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1033466 SUSE bug 1081545 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. Important CVE-2016-9262 at SUSE CVE-2016-9262 at NVD SUSE bug 1009994 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet. Moderate CVE-2016-9310 at SUSE CVE-2016-9310 at NVD SUSE bug 1011377 SUSE bug 1011421 SUSE bug 1012330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet. Moderate CVE-2016-9311 at SUSE CVE-2016-9311 at NVD SUSE bug 1011377 SUSE bug 1011421 SUSE bug 1012330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure. Low CVE-2016-9387 at SUSE CVE-2016-9387 at NVD SUSE bug 1010960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. Moderate CVE-2016-9388 at SUSE CVE-2016-9388 at NVD SUSE bug 1010975 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). Moderate CVE-2016-9389 at SUSE CVE-2016-9389 at NVD SUSE bug 1010968 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. Moderate CVE-2016-9390 at SUSE CVE-2016-9390 at NVD SUSE bug 1010774 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer. Moderate CVE-2016-9391 at SUSE CVE-2016-9391 at NVD SUSE bug 1010782 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. Moderate CVE-2016-9392 at SUSE CVE-2016-9392 at NVD SUSE bug 1010757 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. Moderate CVE-2016-9393 at SUSE CVE-2016-9393 at NVD SUSE bug 1010757 SUSE bug 1010766 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. Moderate CVE-2016-9394 at SUSE CVE-2016-9394 at NVD SUSE bug 1010756 SUSE bug 1010757 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. Low CVE-2016-9396 at SUSE CVE-2016-9396 at NVD SUSE bug 1010783 SUSE bug 1021871 SUSE bug 1082397 SUSE bug 1154883 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. Moderate CVE-2016-9401 at SUSE CVE-2016-9401 at NVD SUSE bug 1010845 SUSE bug 1044328 SUSE bug 1123788 SUSE bug 1159416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DS resource record in an answer. Important CVE-2016-9444 at SUSE CVE-2016-9444 at NVD SUSE bug 1018699 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1033466 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow. Moderate CVE-2016-9445 at SUSE CVE-2016-9445 at NVD SUSE bug 1010829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas. Moderate CVE-2016-9446 at SUSE CVE-2016-9446 at NVD SUSE bug 1010829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file. Important CVE-2016-9447 at SUSE CVE-2016-9447 at NVD SUSE bug 1010514 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow." Moderate CVE-2016-9533 at SUSE CVE-2016-9533 at NVD SUSE bug 1011849 SUSE bug 1013308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow." Moderate CVE-2016-9534 at SUSE CVE-2016-9534 at NVD SUSE bug 1011847 SUSE bug 1013308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow." Moderate CVE-2016-9535 at SUSE CVE-2016-9535 at NVD SUSE bug 1011846 SUSE bug 1013308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow." Moderate CVE-2016-9536 at SUSE CVE-2016-9536 at NVD SUSE bug 1011845 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097. Critical CVE-2016-9537 at SUSE CVE-2016-9537 at NVD SUSE bug 1011842 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow." Moderate CVE-2016-9540 at SUSE CVE-2016-9540 at NVD SUSE bug 1011839 SUSE bug 1013308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. Moderate CVE-2016-9555 at SUSE CVE-2016-9555 at NVD SUSE bug 1011685 SUSE bug 1012183 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image. Important CVE-2016-9560 at SUSE CVE-2016-9560 at NVD SUSE bug 1011830 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap. Moderate CVE-2016-9573 at SUSE CVE-2016-9573 at NVD SUSE bug 1007739 SUSE bug 1007744 SUSE bug 1014543 SUSE bug 1015662 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks. Moderate CVE-2016-9575 at SUSE CVE-2016-9575 at NVD SUSE bug 1015564 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device. Important CVE-2016-9576 at SUSE CVE-2016-9576 at NVD SUSE bug 1013604 SUSE bug 1014271 SUSE bug 1017710 SUSE bug 1019079 SUSE bug 1019668 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution. Important CVE-2016-9577 at SUSE CVE-2016-9577 at NVD SUSE bug 1023078 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash. Important CVE-2016-9578 at SUSE CVE-2016-9578 at NVD SUSE bug 1023078 SUSE bug 1023079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. Moderate CVE-2016-9583 at SUSE CVE-2016-9583 at NVD SUSE bug 1015400 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest. Moderate CVE-2016-9588 at SUSE CVE-2016-9588 at NVD SUSE bug 1015703 SUSE bug 1017512 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. Moderate CVE-2016-9591 at SUSE CVE-2016-9591 at NVD SUSE bug 1015993 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. Moderate CVE-2016-9600 at SUSE CVE-2016-9600 at NVD SUSE bug 1018088 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. Low CVE-2016-9603 at SUSE CVE-2016-9603 at NVD SUSE bug 1028655 SUSE bug 1028656 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring. Moderate CVE-2016-9604 at SUSE CVE-2016-9604 at NVD SUSE bug 1035576 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter. Moderate CVE-2016-9634 at SUSE CVE-2016-9634 at NVD SUSE bug 1012102 SUSE bug 1012103 SUSE bug 1012104 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer. Moderate CVE-2016-9635 at SUSE CVE-2016-9635 at NVD SUSE bug 1012102 SUSE bug 1012103 SUSE bug 1012104 SUSE bug 1013653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer. Moderate CVE-2016-9636 at SUSE CVE-2016-9636 at NVD SUSE bug 1012102 SUSE bug 1012103 SUSE bug 1012104 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code. Important CVE-2016-9675 at SUSE CVE-2016-9675 at NVD SUSE bug 1012822 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations. Low CVE-2016-9685 at SUSE CVE-2016-9685 at NVD SUSE bug 1012832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option. Moderate CVE-2016-9793 at SUSE CVE-2016-9793 at NVD SUSE bug 1013531 SUSE bug 1013542 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated. Important CVE-2016-9806 at SUSE CVE-2016-9806 at NVD SUSE bug 1013540 SUSE bug 1017589 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file. Important CVE-2016-9807 at SUSE CVE-2016-9807 at NVD SUSE bug 1013655 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs. Important CVE-2016-9808 at SUSE CVE-2016-9808 at NVD SUSE bug 1012102 SUSE bug 1012103 SUSE bug 1012104 SUSE bug 1013653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read. Moderate CVE-2016-9809 at SUSE CVE-2016-9809 at NVD SUSE bug 1013659 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call. Moderate CVE-2016-9810 at SUSE CVE-2016-9810 at NVD SUSE bug 1013663 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. Moderate CVE-2016-9811 at SUSE CVE-2016-9811 at NVD SUSE bug 1013669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section. Moderate CVE-2016-9812 at SUSE CVE-2016-9812 at NVD SUSE bug 1013678 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. Important CVE-2016-9813 at SUSE CVE-2016-9813 at NVD SUSE bug 1013680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Critical CVE-2016-9840 at SUSE CVE-2016-9840 at NVD SUSE bug 1003579 SUSE bug 1022633 SUSE bug 1023215 SUSE bug 1038505 SUSE bug 1062104 SUSE bug 1120866 SUSE bug 1123150 SUSE bug 1127473 SUSE bug 1184301 SUSE Liberty Linux 7 Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9893 at SUSE CVE-2016-9893 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9895 at SUSE CVE-2016-9895 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9897 at SUSE CVE-2016-9897 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9898 at SUSE CVE-2016-9898 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9899 at SUSE CVE-2016-9899 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9900 at SUSE CVE-2016-9900 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1. Moderate CVE-2016-9901 at SUSE CVE-2016-9901 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1. Moderate CVE-2016-9902 at SUSE CVE-2016-9902 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Moderate CVE-2016-9904 at SUSE CVE-2016-9904 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6. Moderate CVE-2016-9905 at SUSE CVE-2016-9905 at NVD SUSE bug 1015422 SUSE bug 1015527 SUSE bug 1015528 SUSE bug 1015529 SUSE bug 1015530 SUSE bug 1015531 SUSE bug 1015533 SUSE bug 1015534 SUSE bug 1015535 SUSE bug 1015536 SUSE bug 1015537 SUSE bug 1015538 SUSE bug 1015540 SUSE bug 1015541 SUSE bug 1015542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808. Important CVE-2017-0393 at SUSE CVE-2017-0393 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library. Important CVE-2017-0553 at SUSE CVE-2017-0553 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors. Moderate CVE-2017-0861 at SUSE CVE-2017-0861 at NVD SUSE bug 1088260 SUSE bug 1088268 SUSE bug 1091815 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap. Moderate CVE-2017-0898 at SUSE CVE-2017-0898 at NVD SUSE bug 1058755 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences. Important CVE-2017-0899 at SUSE CVE-2017-0899 at NVD SUSE bug 1056286 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command. Important CVE-2017-0900 at SUSE CVE-2017-0900 at NVD SUSE bug 1056286 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem. Important CVE-2017-0901 at SUSE CVE-2017-0901 at NVD SUSE bug 1056286 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls. Important CVE-2017-0902 at SUSE CVE-2017-0902 at NVD SUSE bug 1056286 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. Moderate CVE-2017-0903 at SUSE CVE-2017-0903 at NVD SUSE bug 1062452 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service. Moderate CVE-2017-1000050 at SUSE CVE-2017-1000050 at NVD SUSE bug 1047958 SUSE bug 1078851 SUSE bug 1178702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service Moderate CVE-2017-1000061 at SUSE CVE-2017-1000061 at NVD SUSE bug 1010675 SUSE bug 1082267 SUSE bug 1118959 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename. Moderate CVE-2017-1000083 at SUSE CVE-2017-1000083 at NVD SUSE bug 1046856 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW. Important CVE-2017-1000111 at SUSE CVE-2017-1000111 at NVD SUSE bug 1052365 SUSE bug 1052367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005. Important CVE-2017-1000112 at SUSE CVE-2017-1000112 at NVD SUSE bug 1052311 SUSE bug 1052365 SUSE bug 1052368 SUSE bug 1072117 SUSE bug 1072162 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository Moderate CVE-2017-1000115 at SUSE CVE-2017-1000115 at NVD SUSE bug 1053344 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks. Important CVE-2017-1000116 at SUSE CVE-2017-1000116 at NVD SUSE bug 1052481 SUSE bug 1052696 SUSE bug 1052932 SUSE bug 1053364 SUSE bug 1054653 SUSE bug 1066430 SUSE bug 1071709 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. Important CVE-2017-1000117 at SUSE CVE-2017-1000117 at NVD SUSE bug 1052481 SUSE bug 1052696 SUSE bug 1052932 SUSE bug 1053364 SUSE bug 1053600 SUSE bug 1053919 SUSE bug 1054653 SUSE bug 1058214 SUSE bug 1066430 SUSE bug 1071709 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. Low CVE-2017-1000250 at SUSE CVE-2017-1000250 at NVD SUSE bug 1057342 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. Moderate CVE-2017-1000251 at SUSE CVE-2017-1000251 at NVD SUSE bug 1057389 SUSE bug 1057950 SUSE bug 1070535 SUSE bug 1072117 SUSE bug 1072162 SUSE bug 1120758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c. Moderate CVE-2017-1000252 at SUSE CVE-2017-1000252 at NVD SUSE bug 1058038 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. Moderate CVE-2017-1000257 at SUSE CVE-2017-1000257 at NVD SUSE bug 1063824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010). Important CVE-2017-1000364 at SUSE CVE-2017-1000364 at NVD SUSE bug 1039346 SUSE bug 1039348 SUSE bug 1042200 SUSE bug 1044985 SUSE bug 1071943 SUSE bug 1075506 SUSE bug 1077345 SUSE bug 1115893 SUSE bug 1149726 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. Important CVE-2017-1000366 at SUSE CVE-2017-1000366 at NVD SUSE bug 1037551 SUSE bug 1039357 SUSE bug 1063847 SUSE bug 1071319 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution. Important CVE-2017-1000367 at SUSE CVE-2017-1000367 at NVD SUSE bug 1007501 SUSE bug 1039361 SUSE bug 1042146 SUSE bug 1077345 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution. Important CVE-2017-1000368 at SUSE CVE-2017-1000368 at NVD SUSE bug 1039361 SUSE bug 1042146 SUSE bug 1045986 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time. Low CVE-2017-1000380 at SUSE CVE-2017-1000380 at NVD SUSE bug 1044125 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic. Moderate CVE-2017-1000407 at SUSE CVE-2017-1000407 at NVD SUSE bug 1071021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes). Low CVE-2017-1000410 at SUSE CVE-2017-1000410 at NVD SUSE bug 1070535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service. Important CVE-2017-1000476 at SUSE CVE-2017-1000476 at NVD SUSE bug 1074610 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10053 at SUSE CVE-2017-10053 at NVD SUSE bug 1049305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Moderate CVE-2017-10067 at SUSE CVE-2017-10067 at NVD SUSE bug 1049306 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2017-10074 at SUSE CVE-2017-10074 at NVD SUSE bug 1049307 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Important CVE-2017-10078 at SUSE CVE-2017-10078 at NVD SUSE bug 1049308 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Moderate CVE-2017-10081 at SUSE CVE-2017-10081 at NVD SUSE bug 1049309 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10087 at SUSE CVE-2017-10087 at NVD SUSE bug 1049311 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10089 at SUSE CVE-2017-10089 at NVD SUSE bug 1049312 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10090 at SUSE CVE-2017-10090 at NVD SUSE bug 1049313 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10096 at SUSE CVE-2017-10096 at NVD SUSE bug 1049314 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10101 at SUSE CVE-2017-10101 at NVD SUSE bug 1049315 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Moderate CVE-2017-10102 at SUSE CVE-2017-10102 at NVD SUSE bug 1049316 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Critical CVE-2017-10107 at SUSE CVE-2017-10107 at NVD SUSE bug 1049318 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10108 at SUSE CVE-2017-10108 at NVD SUSE bug 1049319 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10109 at SUSE CVE-2017-10109 at NVD SUSE bug 1049320 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10110 at SUSE CVE-2017-10110 at NVD SUSE bug 1049321 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10111 at SUSE CVE-2017-10111 at NVD SUSE bug 1049322 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Important CVE-2017-10115 at SUSE CVE-2017-10115 at NVD SUSE bug 1020905 SUSE bug 1049324 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2017-10116 at SUSE CVE-2017-10116 at NVD SUSE bug 1049325 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2017-10135 at SUSE CVE-2017-10135 at NVD SUSE bug 1049328 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Low CVE-2017-10193 at SUSE CVE-2017-10193 at NVD SUSE bug 1049330 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Moderate CVE-2017-10198 at SUSE CVE-2017-10198 at NVD SUSE bug 1049331 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Moderate CVE-2017-10243 at SUSE CVE-2017-10243 at NVD SUSE bug 1049332 SUSE bug 1049333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2017-10268 at SUSE CVE-2017-10268 at NVD SUSE bug 1064101 SUSE bug 1064119 SUSE bug 1076505 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Moderate CVE-2017-10274 at SUSE CVE-2017-10274 at NVD SUSE bug 1064071 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10281 at SUSE CVE-2017-10281 at NVD SUSE bug 1064072 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2017-10285 at SUSE CVE-2017-10285 at NVD SUSE bug 1064073 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). Moderate CVE-2017-10295 at SUSE CVE-2017-10295 at NVD SUSE bug 1064075 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). Low CVE-2017-10345 at SUSE CVE-2017-10345 at NVD SUSE bug 1064077 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-10346 at SUSE CVE-2017-10346 at NVD SUSE bug 1064078 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10347 at SUSE CVE-2017-10347 at NVD SUSE bug 1064079 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10348 at SUSE CVE-2017-10348 at NVD SUSE bug 1064080 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10349 at SUSE CVE-2017-10349 at NVD SUSE bug 1064081 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10350 at SUSE CVE-2017-10350 at NVD SUSE bug 1064082 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10355 at SUSE CVE-2017-10355 at NVD SUSE bug 1064083 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2017-10356 at SUSE CVE-2017-10356 at NVD SUSE bug 1064084 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2017-10357 at SUSE CVE-2017-10357 at NVD SUSE bug 1064085 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2017-10378 at SUSE CVE-2017-10378 at NVD SUSE bug 1064115 SUSE bug 1064119 SUSE bug 1076505 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2017-10379 at SUSE CVE-2017-10379 at NVD SUSE bug 1064116 SUSE bug 1064119 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2017-10384 at SUSE CVE-2017-10384 at NVD SUSE bug 1064117 SUSE bug 1064119 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Moderate CVE-2017-10388 at SUSE CVE-2017-10388 at NVD SUSE bug 1064086 SUSE bug 1070162 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. Important CVE-2017-10661 at SUSE CVE-2017-10661 at NVD SUSE bug 1053152 SUSE bug 1053153 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt. Moderate CVE-2017-10664 at SUSE CVE-2017-10664 at NVD SUSE bug 1046636 SUSE bug 1046637 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name. Moderate CVE-2017-10784 at SUSE CVE-2017-10784 at NVD SUSE bug 1058754 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service. Moderate CVE-2017-10978 at SUSE CVE-2017-10978 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service. Moderate CVE-2017-10983 at SUSE CVE-2017-10983 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code. Moderate CVE-2017-10984 at SUSE CVE-2017-10984 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service. Moderate CVE-2017-10985 at SUSE CVE-2017-10985 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service. Moderate CVE-2017-10986 at SUSE CVE-2017-10986 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service. Moderate CVE-2017-10987 at SUSE CVE-2017-10987 at NVD SUSE bug 1049086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file. Moderate CVE-2017-11166 at SUSE CVE-2017-11166 at NVD SUSE bug 1048110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. Important CVE-2017-11176 at SUSE CVE-2017-11176 at NVD SUSE bug 1048275 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. Moderate CVE-2017-11368 at SUSE CVE-2017-11368 at NVD SUSE bug 1049819 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Important CVE-2017-11600 at SUSE CVE-2017-11600 at NVD SUSE bug 1050231 SUSE bug 1096564 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation. Moderate CVE-2017-11671 at SUSE CVE-2017-11671 at NVD SUSE bug 1050947 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation. Moderate CVE-2017-12132 at SUSE CVE-2017-12132 at NVD SUSE bug 1051791 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text. Important CVE-2017-12150 at SUSE CVE-2017-12150 at NVD SUSE bug 1058622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. Important CVE-2017-12151 at SUSE CVE-2017-12151 at NVD SUSE bug 1058565 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register. Moderate CVE-2017-12154 at SUSE CVE-2017-12154 at NVD SUSE bug 1058038 SUSE bug 1058507 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. Moderate CVE-2017-12163 at SUSE CVE-2017-12163 at NVD SUSE bug 1058410 SUSE bug 1058624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server. Important CVE-2017-12172 at SUSE CVE-2017-12172 at NVD SUSE bug 1062538 SUSE bug 1062722 SUSE bug 1185814 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Low CVE-2017-12173 at SUSE CVE-2017-12173 at NVD SUSE bug 1061832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun." Moderate CVE-2017-12188 at SUSE CVE-2017-12188 at NVD SUSE bug 1062604 SUSE bug 1096566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition. Moderate CVE-2017-12190 at SUSE CVE-2017-12190 at NVD SUSE bug 1062568 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation. Moderate CVE-2017-12192 at SUSE CVE-2017-12192 at NVD SUSE bug 1062840 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. Moderate CVE-2017-12193 at SUSE CVE-2017-12193 at NVD SUSE bug 1066192 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input. Low CVE-2017-12613 at SUSE CVE-2017-12613 at NVD SUSE bug 1064982 SUSE bug 1190072 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Moderate CVE-2017-12615 at SUSE CVE-2017-12615 at NVD SUSE bug 1059554 SUSE bug 1180947 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Moderate CVE-2017-12617 at SUSE CVE-2017-12617 at NVD SUSE bug 1059554 SUSE bug 1062607 SUSE bug 1180947 SUSE bug 1189861 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libpng before 1.6.32 does not properly check the length of chunks against the user limit. Low CVE-2017-12652 at SUSE CVE-2017-12652 at NVD SUSE bug 1141493 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. Low CVE-2017-12805 at SUSE CVE-2017-12805 at NVD SUSE bug 1135236 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. Low CVE-2017-12806 at SUSE CVE-2017-12806 at NVD SUSE bug 1135232 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Moderate CVE-2017-13077 at SUSE CVE-2017-13077 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063963 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients. Moderate CVE-2017-13078 at SUSE CVE-2017-13078 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063667 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients. Moderate CVE-2017-13080 at SUSE CVE-2017-13080 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1063667 SUSE bug 1063671 SUSE bug 1066295 SUSE bug 1105108 SUSE bug 1178872 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Moderate CVE-2017-13082 at SUSE CVE-2017-13082 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames. Moderate CVE-2017-13086 at SUSE CVE-2017-13086 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. Moderate CVE-2017-13087 at SUSE CVE-2017-13087 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients. Moderate CVE-2017-13088 at SUSE CVE-2017-13088 at NVD SUSE bug 1056061 SUSE bug 1063479 SUSE bug 1179588 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. Important CVE-2017-13089 at SUSE CVE-2017-13089 at NVD SUSE bug 1064715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer. Important CVE-2017-13090 at SUSE CVE-2017-13090 at NVD SUSE bug 1064716 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167. Moderate CVE-2017-13166 at SUSE CVE-2017-13166 at NVD SUSE bug 1072865 SUSE bug 1074488 SUSE bug 1085447 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel. Moderate CVE-2017-13215 at SUSE CVE-2017-13215 at NVD SUSE bug 1075908 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update. Low CVE-2017-13672 at SUSE CVE-2017-13672 at NVD SUSE bug 1056334 SUSE bug 1056336 SUSE bug 1084604 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets. Low CVE-2017-13711 at SUSE CVE-2017-13711 at NVD SUSE bug 1056291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0. Important CVE-2017-13738 at SUSE CVE-2017-13738 at NVD SUSE bug 1056105 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of service or possibly unspecified other impact. Important CVE-2017-13740 at SUSE CVE-2017-13740 at NVD SUSE bug 1056097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remote denial of service attack. Important CVE-2017-13741 at SUSE CVE-2017-13741 at NVD SUSE bug 1056095 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will lead to a remote denial of service attack. Important CVE-2017-13742 at SUSE CVE-2017-13742 at NVD SUSE bug 1056093 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of service attack. Important CVE-2017-13743 at SUSE CVE-2017-13743 at NVD SUSE bug 1056090 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0. Important CVE-2017-13744 at SUSE CVE-2017-13744 at NVD SUSE bug 1056088 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string. Moderate CVE-2017-14033 at SUSE CVE-2017-14033 at NVD SUSE bug 1058757 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. Moderate CVE-2017-14064 at SUSE CVE-2017-14064 at NVD SUSE bug 1056782 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path. Moderate CVE-2017-14106 at SUSE CVE-2017-14106 at NVD SUSE bug 1056982 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR. Low CVE-2017-14140 at SUSE CVE-2017-14140 at NVD SUSE bug 1057179 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write. Low CVE-2017-14167 at SUSE CVE-2017-14167 at NVD SUSE bug 1057585 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article). Critical CVE-2017-14482 at SUSE CVE-2017-14482 at NVD SUSE bug 1058425 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Moderate CVE-2017-14491 at SUSE CVE-2017-14491 at NVD SUSE bug 1060354 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 SUSE bug 1143944 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request. Moderate CVE-2017-14492 at SUSE CVE-2017-14492 at NVD SUSE bug 1060355 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request. Moderate CVE-2017-14493 at SUSE CVE-2017-14493 at NVD SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 SUSE bug 1063832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests. Moderate CVE-2017-14494 at SUSE CVE-2017-14494 at NVD SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation. Important CVE-2017-14495 at SUSE CVE-2017-14495 at NVD SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request. Important CVE-2017-14496 at SUSE CVE-2017-14496 at NVD SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16. Moderate CVE-2017-14503 at SUSE CVE-2017-14503 at NVD SUSE bug 1059100 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field. Moderate CVE-2017-14604 at SUSE CVE-2017-14604 at NVD SUSE bug 1060031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. Important CVE-2017-14746 at SUSE CVE-2017-14746 at NVD SUSE bug 1060427 SUSE bug 1069666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get." Critical CVE-2017-15041 at SUSE CVE-2017-15041 at NVD SUSE bug 1062085 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password. Low CVE-2017-15042 at SUSE CVE-2017-15042 at NVD SUSE bug 1062087 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine. Important CVE-2017-15097 at SUSE CVE-2017-15097 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could cause a denial of service condition or potentially even arbitrary code execution. Important CVE-2017-15101 at SUSE CVE-2017-15101 at NVD SUSE bug 1067336 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link. Moderate CVE-2017-15111 at SUSE CVE-2017-15111 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users. Important CVE-2017-15112 at SUSE CVE-2017-15112 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference). Low CVE-2017-15116 at SUSE CVE-2017-15116 at NVD SUSE bug 1070613 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary. Moderate CVE-2017-15121 at SUSE CVE-2017-15121 at NVD SUSE bug 1071726 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host. Moderate CVE-2017-15124 at SUSE CVE-2017-15124 at NVD SUSE bug 1073489 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put(). Critical CVE-2017-15126 at SUSE CVE-2017-15126 at NVD SUSE bug 1073108 SUSE bug 1171522 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VM_SHARED hugetlbfs mapping could trigger a local denial of service (BUG). Moderate CVE-2017-15127 at SUSE CVE-2017-15127 at NVD SUSE bug 1073113 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely. Moderate CVE-2017-15129 at SUSE CVE-2017-15129 at NVD SUSE bug 1074839 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux. Important CVE-2017-15131 at SUSE CVE-2017-15131 at NVD SUSE bug 1075378 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service. Low CVE-2017-15134 at SUSE CVE-2017-15134 at NVD SUSE bug 1007004 SUSE bug 1076530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances. Low CVE-2017-15135 at SUSE CVE-2017-15135 at NVD SUSE bug 1007004 SUSE bug 1076530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. Moderate CVE-2017-15265 at SUSE CVE-2017-15265 at NVD SUSE bug 1062520 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c. Moderate CVE-2017-15268 at SUSE CVE-2017-15268 at NVD SUSE bug 1062942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. Moderate CVE-2017-15275 at SUSE CVE-2017-15275 at NVD SUSE bug 1063008 SUSE bug 1069666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation. Moderate CVE-2017-15289 at SUSE CVE-2017-15289 at NVD SUSE bug 1063122 SUSE bug 1063123 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Moderate CVE-2017-15412 at SUSE CVE-2017-15412 at NVD SUSE bug 1071691 SUSE bug 1077993 SUSE bug 1123129 SUSE bug 1123919 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346. Important CVE-2017-15649 at SUSE CVE-2017-15649 at NVD SUSE bug 1064388 SUSE bug 1064392 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. Important CVE-2017-15670 at SUSE CVE-2017-15670 at NVD SUSE bug 1064583 SUSE bug 1110160 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future. Important CVE-2017-15705 at SUSE CVE-2017-15705 at NVD SUSE bug 1108745 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. Moderate CVE-2017-15710 at SUSE CVE-2017-15710 at NVD SUSE bug 1086776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename. Moderate CVE-2017-15715 at SUSE CVE-2017-15715 at NVD SUSE bug 1086774 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator. Moderate CVE-2017-15804 at SUSE CVE-2017-15804 at NVD SUSE bug 1064580 SUSE bug 1110160 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. Moderate CVE-2017-15906 at SUSE CVE-2017-15906 at NVD SUSE bug 1064285 SUSE bug 1065000 SUSE bug 1074115 SUSE bug 1079488 SUSE bug 1090163 SUSE bug 1099316 SUSE bug 1138392 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected. Moderate CVE-2017-16541 at SUSE CVE-2017-16541 at NVD SUSE bug 1066489 SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. Moderate CVE-2017-16844 at SUSE CVE-2017-16844 at NVD SUSE bug 1068648 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. Moderate CVE-2017-16939 at SUSE CVE-2017-16939 at NVD SUSE bug 1069702 SUSE bug 1069708 SUSE bug 1115893 SUSE bug 1120260 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution. Important CVE-2017-16997 at SUSE CVE-2017-16997 at NVD SUSE bug 1073231 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution. Important CVE-2017-17405 at SUSE CVE-2017-17405 at NVD SUSE bug 1073002 SUSE bug 1078782 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. Moderate CVE-2017-17448 at SUSE CVE-2017-17448 at NVD SUSE bug 1071693 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. Moderate CVE-2017-17449 at SUSE CVE-2017-17449 at NVD SUSE bug 1071694 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device. Moderate CVE-2017-17558 at SUSE CVE-2017-17558 at NVD SUSE bug 1072561 SUSE bug 1087082 SUSE bug 1146519 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attackers can exploit this vulnerability to cause a denial of service via a crafted TIFF file. Low CVE-2017-17724 at SUSE CVE-2017-17724 at NVD SUSE bug 1080736 SUSE bug 1087892 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick. Moderate CVE-2017-17742 at SUSE CVE-2017-17742 at NVD SUSE bug 1087434 SUSE bug 1136906 SUSE bug 1152992 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely. Moderate CVE-2017-17790 at SUSE CVE-2017-17790 at NVD SUSE bug 1073002 SUSE bug 1078782 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. Important CVE-2017-17805 at SUSE CVE-2017-17805 at NVD SUSE bug 1073792 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c. Moderate CVE-2017-17807 at SUSE CVE-2017-17807 at NVD SUSE bug 1073860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. Important CVE-2017-17833 at SUSE CVE-2017-17833 at NVD SUSE bug 1090638 SUSE bug 1099519 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. Moderate CVE-2017-18017 at SUSE CVE-2017-18017 at NVD SUSE bug 1074488 SUSE bug 1080255 SUSE bug 1091815 SUSE bug 1115893 SUSE bug 971126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service. Moderate CVE-2017-18189 at SUSE CVE-2017-18189 at NVD SUSE bug 1081146 SUSE bug 1141667 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1). Important CVE-2017-18190 at SUSE CVE-2017-18190 at NVD SUSE bug 1081557 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted iso file. Moderate CVE-2017-18198 at SUSE CVE-2017-18198 at NVD SUSE bug 1082819 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file. Low CVE-2017-18199 at SUSE CVE-2017-18199 at NVD SUSE bug 1082821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c. Moderate CVE-2017-18201 at SUSE CVE-2017-18201 at NVD SUSE bug 1082877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices. Moderate CVE-2017-18203 at SUSE CVE-2017-18203 at NVD SUSE bug 1083242 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set. Low CVE-2017-18205 at SUSE CVE-2017-18205 at NVD SUSE bug 1082998 SUSE bug 1200039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In utils.c in zsh before 5.4, symlink expansion had a buffer overflow. Moderate CVE-2017-18206 at SUSE CVE-2017-18206 at NVD SUSE bug 1083002 SUSE bug 1215218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping. Moderate CVE-2017-18208 at SUSE CVE-2017-18208 at NVD SUSE bug 1083494 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code. Low CVE-2017-18232 at SUSE CVE-2017-18232 at NVD SUSE bug 1085413 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file. Low CVE-2017-18233 at SUSE CVE-2017-18233 at NVD SUSE bug 1085584 SUSE bug 1085585 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp. Moderate CVE-2017-18234 at SUSE CVE-2017-18234 at NVD SUSE bug 1085585 SUSE bug 1103718 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file. Low CVE-2017-18236 at SUSE CVE-2017-18236 at NVD SUSE bug 1085585 SUSE bug 1085589 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file. Low CVE-2017-18238 at SUSE CVE-2017-18238 at NVD SUSE bug 1085583 SUSE bug 1085585 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted file. Low CVE-2017-18251 at SUSE CVE-2017-18251 at NVD SUSE bug 1087037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file. Low CVE-2017-18252 at SUSE CVE-2017-18252 at NVD SUSE bug 1087033 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted file. Low CVE-2017-18254 at SUSE CVE-2017-18254 at NVD SUSE bug 1087027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. Low CVE-2017-18258 at SUSE CVE-2017-18258 at NVD SUSE bug 1088279 SUSE bug 1088601 SUSE bug 1105166 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops. Low CVE-2017-18267 at SUSE CVE-2017-18267 at NVD SUSE bug 1092945 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file. Low CVE-2017-18271 at SUSE CVE-2017-18271 at NVD SUSE bug 1094204 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call. Important CVE-2017-18273 at SUSE CVE-2017-18273 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE). Moderate CVE-2017-18344 at SUSE CVE-2017-18344 at NVD SUSE bug 1087082 SUSE bug 1102851 SUSE bug 1103203 SUSE bug 1103580 SUSE bug 1215674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated. Moderate CVE-2017-18551 at SUSE CVE-2017-18551 at NVD SUSE bug 1146163 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c. Low CVE-2017-18595 at SUSE CVE-2017-18595 at NVD SUSE bug 1149555 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. Important CVE-2017-18922 at SUSE CVE-2017-18922 at NVD SUSE bug 1173477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application. Moderate CVE-2017-2583 at SUSE CVE-2017-2583 at NVD SUSE bug 1020602 SUSE bug 1030573 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys. Important CVE-2017-2590 at SUSE CVE-2017-2590 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references. Low CVE-2017-2596 at SUSE CVE-2017-2596 at NVD SUSE bug 1022785 SUSE bug 1027179 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. Moderate CVE-2017-2615 at SUSE CVE-2017-2615 at NVD SUSE bug 1023004 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. Important CVE-2017-2616 at SUSE CVE-2017-2616 at NVD SUSE bug 1023041 SUSE bug 1123789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. Moderate CVE-2017-2618 at SUSE CVE-2017-2618 at NVD SUSE bug 1253081 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Important CVE-2017-2619 at SUSE CVE-2017-2619 at NVD SUSE bug 1027147 SUSE bug 1036283 SUSE bug 1054017 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. Moderate CVE-2017-2620 at SUSE CVE-2017-2620 at NVD SUSE bug 1024834 SUSE bug 1024972 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions. Moderate CVE-2017-2625 at SUSE CVE-2017-2625 at NVD SUSE bug 1025046 SUSE bug 1025068 SUSE bug 1025639 SUSE bug 1123802 SUSE bug 815650 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list. Moderate CVE-2017-2626 at SUSE CVE-2017-2626 at NVD SUSE bug 1025068 SUSE bug 1025639 SUSE bug 1048274 SUSE bug 1123800 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process. Low CVE-2017-2633 at SUSE CVE-2017-2633 at NVD SUSE bug 1026612 SUSE bug 1026636 SUSE bug 1074701 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Moderate CVE-2017-2636 at SUSE CVE-2017-2636 at NVD SUSE bug 1027565 SUSE bug 1027575 SUSE bug 1028372 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. Important CVE-2017-2640 at SUSE CVE-2017-2640 at NVD SUSE bug 1028835 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. Important CVE-2017-2647 at SUSE CVE-2017-2647 at NVD SUSE bug 1030593 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. Critical CVE-2017-2668 at SUSE CVE-2017-2668 at NVD SUSE bug 1069067 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. Important CVE-2017-2671 at SUSE CVE-2017-2671 at NVD SUSE bug 1027179 SUSE bug 1031003 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability. Important CVE-2017-2862 at SUSE CVE-2017-2862 at NVD SUSE bug 1048289 SUSE Liberty Linux 7 An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability. Important CVE-2017-2885 at SUSE CVE-2017-2885 at NVD SUSE bug 1052916 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1. Important CVE-2017-3135 at SUSE CVE-2017-3135 at NVD SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1024130 SUSE bug 1033466 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8. Important CVE-2017-3136 at SUSE CVE-2017-3136 at NVD SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1024130 SUSE bug 1033461 SUSE bug 1033466 SUSE bug 1081545 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8. Important CVE-2017-3137 at SUSE CVE-2017-3137 at NVD SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 SUSE bug 1024130 SUSE bug 1033461 SUSE bug 1033466 SUSE bug 1033467 SUSE bug 1034162 SUSE bug 1076118 SUSE bug 1081545 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. Important CVE-2017-3142 at SUSE CVE-2017-3142 at NVD SUSE bug 1024130 SUSE bug 1046554 SUSE bug 1046555 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. Important CVE-2017-3143 at SUSE CVE-2017-3143 at NVD SUSE bug 1024130 SUSE bug 1046554 SUSE bug 1046555 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested. Moderate CVE-2017-3144 at SUSE CVE-2017-3144 at NVD SUSE bug 1076118 SUSE bug 1076119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1. Important CVE-2017-3145 at SUSE CVE-2017-3145 at NVD SUSE bug 1076118 SUSE bug 1101131 SUSE bug 1177790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Moderate CVE-2017-3167 at SUSE CVE-2017-3167 at NVD SUSE bug 1045065 SUSE bug 1078450 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Moderate CVE-2017-3169 at SUSE CVE-2017-3169 at NVD SUSE bug 1045062 SUSE bug 1078450 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts). Moderate CVE-2017-3231 at SUSE CVE-2017-3231 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts). Moderate CVE-2017-3238 at SUSE CVE-2017-3238 at NVD SUSE bug 1020868 SUSE bug 1020882 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). Important CVE-2017-3241 at SUSE CVE-2017-3241 at NVD SUSE bug 1020905 SUSE bug 1024218 SUSE bug 1163365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.53 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.4 (Availability impacts). Moderate CVE-2017-3243 at SUSE CVE-2017-3243 at NVD SUSE bug 1020868 SUSE bug 1020891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts). Moderate CVE-2017-3244 at SUSE CVE-2017-3244 at NVD SUSE bug 1020868 SUSE bug 1020877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.8 (Integrity impacts). Important CVE-2017-3252 at SUSE CVE-2017-3252 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Availability impacts). Important CVE-2017-3253 at SUSE CVE-2017-3253 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts). Moderate CVE-2017-3258 at SUSE CVE-2017-3258 at NVD SUSE bug 1020868 SUSE bug 1020875 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 4.3 (Confidentiality impacts). Moderate CVE-2017-3261 at SUSE CVE-2017-3261 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 5.6 (Confidentiality and Availability impacts). Moderate CVE-2017-3265 at SUSE CVE-2017-3265 at NVD SUSE bug 1020868 SUSE bug 1020885 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). Important CVE-2017-3272 at SUSE CVE-2017-3272 at NVD SUSE bug 1020905 SUSE bug 1024218 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). Critical CVE-2017-3289 at SUSE CVE-2017-3289 at NVD SUSE bug 1020905 SUSE bug 1024218 SUSE bug 1163365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). Moderate CVE-2017-3291 at SUSE CVE-2017-3291 at NVD SUSE bug 1020868 SUSE bug 1020884 SUSE bug 998309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through 10.2.3. Moderate CVE-2017-3302 at SUSE CVE-2017-3302 at NVD SUSE bug 1022428 SUSE bug 1034850 SUSE bug 1034911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Low CVE-2017-3308 at SUSE CVE-2017-3308 at NVD SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Low CVE-2017-3309 at SUSE CVE-2017-3309 at NVD SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS v3.0 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). Moderate CVE-2017-3312 at SUSE CVE-2017-3312 at NVD SUSE bug 1020868 SUSE bug 1020873 SUSE bug 998309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts). Low CVE-2017-3313 at SUSE CVE-2017-3313 at NVD SUSE bug 1020868 SUSE bug 1020890 SUSE bug 1034911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.0 (Availability impacts). Low CVE-2017-3317 at SUSE CVE-2017-3317 at NVD SUSE bug 1020868 SUSE bug 1020894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.0 (Confidentiality impacts). Moderate CVE-2017-3318 at SUSE CVE-2017-3318 at NVD SUSE bug 1020868 SUSE bug 1020896 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Low CVE-2017-3453 at SUSE CVE-2017-3453 at NVD SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Low CVE-2017-3456 at SUSE CVE-2017-3456 at NVD SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Low CVE-2017-3464 at SUSE CVE-2017-3464 at NVD SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Moderate CVE-2017-3509 at SUSE CVE-2017-3509 at NVD SUSE bug 1034849 SUSE bug 1038505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2017-3511 at SUSE CVE-2017-3511 at NVD SUSE bug 1034849 SUSE bug 1038505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Important CVE-2017-3526 at SUSE CVE-2017-3526 at NVD SUSE bug 1034849 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2017-3533 at SUSE CVE-2017-3533 at NVD SUSE bug 1034849 SUSE bug 1038505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Moderate CVE-2017-3539 at SUSE CVE-2017-3539 at NVD SUSE bug 1005522 SUSE bug 1034849 SUSE bug 1038505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Important CVE-2017-3544 at SUSE CVE-2017-3544 at NVD SUSE bug 1034849 SUSE bug 1038505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Low CVE-2017-3600 at SUSE CVE-2017-3600 at NVD SUSE bug 1029014 SUSE bug 1034850 SUSE bug 1048715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Moderate CVE-2017-3636 at SUSE CVE-2017-3636 at NVD SUSE bug 1049399 SUSE bug 1049422 SUSE bug 1054591 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2017-3641 at SUSE CVE-2017-3641 at NVD SUSE bug 1049404 SUSE bug 1049422 SUSE bug 1054591 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2017-3651 at SUSE CVE-2017-3651 at NVD SUSE bug 1049415 SUSE bug 1049422 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Low CVE-2017-3653 at SUSE CVE-2017-3653 at NVD SUSE bug 1049417 SUSE bug 1049422 SUSE bug 1054591 SUSE bug 1076506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. Moderate CVE-2017-3731 at SUSE CVE-2017-3731 at NVD SUSE bug 1021641 SUSE bug 1022085 SUSE bug 1064118 SUSE bug 1064119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. Low CVE-2017-3735 at SUSE CVE-2017-3735 at NVD SUSE bug 1056058 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. Moderate CVE-2017-3736 at SUSE CVE-2017-3736 at NVD SUSE bug 1066242 SUSE bug 1071906 SUSE bug 1076369 SUSE bug 957814 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. Moderate CVE-2017-3737 at SUSE CVE-2017-3737 at NVD SUSE bug 1071905 SUSE bug 1072322 SUSE bug 1076369 SUSE bug 1089987 SUSE bug 1089997 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. Low CVE-2017-3738 at SUSE CVE-2017-3738 at NVD SUSE bug 1071906 SUSE bug 1097757 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). Moderate CVE-2017-5202 at SUSE CVE-2017-5202 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). Moderate CVE-2017-5203 at SUSE CVE-2017-5203 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print(). Moderate CVE-2017-5204 at SUSE CVE-2017-5204 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print(). Moderate CVE-2017-5205 at SUSE CVE-2017-5205 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code. Important CVE-2017-5208 at SUSE CVE-2017-5208 at NVD SUSE bug 1018756 SUSE bug 1019328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable. Important CVE-2017-5332 at SUSE CVE-2017-5332 at NVD SUSE bug 1018756 SUSE bug 1019328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file. Important CVE-2017-5333 at SUSE CVE-2017-5333 at NVD SUSE bug 1018756 SUSE bug 1019328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension. Moderate CVE-2017-5334 at SUSE CVE-2017-5334 at NVD SUSE bug 1018831 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate. Moderate CVE-2017-5335 at SUSE CVE-2017-5335 at NVD SUSE bug 1018832 SUSE bug 1021057 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. Moderate CVE-2017-5336 at SUSE CVE-2017-5336 at NVD SUSE bug 1018832 SUSE bug 1021057 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate. Moderate CVE-2017-5337 at SUSE CVE-2017-5337 at NVD SUSE bug 1018832 SUSE bug 1021057 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print(). Moderate CVE-2017-5341 at SUSE CVE-2017-5341 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print(). Moderate CVE-2017-5342 at SUSE CVE-2017-5342 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Important CVE-2017-5373 at SUSE CVE-2017-5373 at NVD SUSE bug 1021824 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Important CVE-2017-5375 at SUSE CVE-2017-5375 at NVD SUSE bug 1021814 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Important CVE-2017-5376 at SUSE CVE-2017-5376 at NVD SUSE bug 1021817 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Moderate CVE-2017-5378 at SUSE CVE-2017-5378 at NVD SUSE bug 1021818 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Moderate CVE-2017-5380 at SUSE CVE-2017-5380 at NVD SUSE bug 1021819 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Moderate CVE-2017-5383 at SUSE CVE-2017-5383 at NVD SUSE bug 1021822 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51. Moderate CVE-2017-5386 at SUSE CVE-2017-5386 at NVD SUSE bug 1021823 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Moderate CVE-2017-5390 at SUSE CVE-2017-5390 at NVD SUSE bug 1021820 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Moderate CVE-2017-5396 at SUSE CVE-2017-5396 at NVD SUSE bug 1021821 SUSE bug 1021991 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5398 at SUSE CVE-2017-5398 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5400 at SUSE CVE-2017-5400 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5401 at SUSE CVE-2017-5401 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5402 at SUSE CVE-2017-5402 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5404 at SUSE CVE-2017-5404 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5405 at SUSE CVE-2017-5405 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5407 at SUSE CVE-2017-5407 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5408 at SUSE CVE-2017-5408 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Moderate CVE-2017-5410 at SUSE CVE-2017-5410 at NVD SUSE bug 1028391 SUSE bug 1028393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1. Important CVE-2017-5428 at SUSE CVE-2017-5428 at NVD SUSE bug 1029822 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5429 at SUSE CVE-2017-5429 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5430 at SUSE CVE-2017-5430 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5432 at SUSE CVE-2017-5432 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5433 at SUSE CVE-2017-5433 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5434 at SUSE CVE-2017-5434 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5435 at SUSE CVE-2017-5435 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5436 at SUSE CVE-2017-5436 at NVD SUSE bug 1035082 SUSE bug 1035204 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197. Reason: This candidate is a duplicate of CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. Notes: All CVE users should reference CVE-2016-10195, CVE-2016-10196, and/or CVE-2016-10197 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Important CVE-2017-5437 at SUSE CVE-2017-5437 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5438 at SUSE CVE-2017-5438 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5439 at SUSE CVE-2017-5439 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5440 at SUSE CVE-2017-5440 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5441 at SUSE CVE-2017-5441 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5442 at SUSE CVE-2017-5442 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5443 at SUSE CVE-2017-5443 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5444 at SUSE CVE-2017-5444 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5445 at SUSE CVE-2017-5445 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5446 at SUSE CVE-2017-5446 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5447 at SUSE CVE-2017-5447 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5448 at SUSE CVE-2017-5448 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5449 at SUSE CVE-2017-5449 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5451 at SUSE CVE-2017-5451 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Low CVE-2017-5454 at SUSE CVE-2017-5454 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53. Moderate CVE-2017-5455 at SUSE CVE-2017-5455 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53. Moderate CVE-2017-5456 at SUSE CVE-2017-5456 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5459 at SUSE CVE-2017-5459 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5460 at SUSE CVE-2017-5460 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations. Important CVE-2017-5461 at SUSE CVE-2017-5461 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5464 at SUSE CVE-2017-5464 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5465 at SUSE CVE-2017-5465 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5466 at SUSE CVE-2017-5466 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5467 at SUSE CVE-2017-5467 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. Moderate CVE-2017-5469 at SUSE CVE-2017-5469 at NVD SUSE bug 1035082 SUSE bug 1035209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-5470 at SUSE CVE-2017-5470 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-5472 at SUSE CVE-2017-5472 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575. Moderate CVE-2017-5482 at SUSE CVE-2017-5482 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The SNMP parser in tcpdump before 4.9.0 has a buffer overflow in print-snmp.c:asn1_parse(). Moderate CVE-2017-5483 at SUSE CVE-2017-5483 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sig_print(). Moderate CVE-2017-5484 at SUSE CVE-2017-5484 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookup_nsap(). Moderate CVE-2017-5485 at SUSE CVE-2017-5485 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). Moderate CVE-2017-5486 at SUSE CVE-2017-5486 at NVD SUSE bug 1020940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries. Moderate CVE-2017-5581 at SUSE CVE-2017-5581 at NVD SUSE bug 1019274 SUSE bug 1021302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. Moderate CVE-2017-5645 at SUSE CVE-2017-5645 at NVD SUSE bug 1034569 SUSE bug 1159646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. Important CVE-2017-5647 at SUSE CVE-2017-5647 at NVD SUSE bug 1033448 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Low CVE-2017-5648 at SUSE CVE-2017-5648 at NVD SUSE bug 1033447 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method. Important CVE-2017-5664 at SUSE CVE-2017-5664 at NVD SUSE bug 1042910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Important CVE-2017-5715 at SUSE CVE-2017-5715 at NVD SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1074741 SUSE bug 1074919 SUSE bug 1075006 SUSE bug 1075007 SUSE bug 1075262 SUSE bug 1075419 SUSE bug 1076115 SUSE bug 1076372 SUSE bug 1076606 SUSE bug 1078353 SUSE bug 1080039 SUSE bug 1087887 SUSE bug 1087939 SUSE bug 1088147 SUSE bug 1089055 SUSE bug 1091815 SUSE bug 1095735 SUSE bug 1102517 SUSE bug 1105108 SUSE bug 1126516 SUSE bug 1173489 SUSE bug 1178658 SUSE bug 1201457 SUSE bug 1201877 SUSE bug 1203236 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access. Important CVE-2017-5731 at SUSE CVE-2017-5731 at NVD SUSE bug 1115917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none Moderate CVE-2017-5732 at SUSE CVE-2017-5732 at NVD SUSE bug 1115917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none Moderate CVE-2017-5733 at SUSE CVE-2017-5733 at NVD SUSE bug 1115917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none Moderate CVE-2017-5734 at SUSE CVE-2017-5734 at NVD SUSE bug 1115917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none Moderate CVE-2017-5735 at SUSE CVE-2017-5735 at NVD SUSE bug 1115917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Important CVE-2017-5753 at SUSE CVE-2017-5753 at NVD SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1075006 SUSE bug 1075419 SUSE bug 1075748 SUSE bug 1080039 SUSE bug 1087084 SUSE bug 1087939 SUSE bug 1089055 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 SUSE bug 1209547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. Important CVE-2017-5754 at SUSE CVE-2017-5754 at NVD SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1075006 SUSE bug 1075008 SUSE bug 1087939 SUSE bug 1089055 SUSE bug 1115045 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file. Low CVE-2017-5837 at SUSE CVE-2017-5837 at NVD SUSE bug 1023259 SUSE bug 1024076 SUSE bug 1024079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string. Moderate CVE-2017-5838 at SUSE CVE-2017-5838 at NVD SUSE bug 1023259 SUSE bug 1024051 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX. Low CVE-2017-5839 at SUSE CVE-2017-5839 at NVD SUSE bug 1023259 SUSE bug 1024047 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index. Low CVE-2017-5840 at SUSE CVE-2017-5840 at NVD SUSE bug 1023259 SUSE bug 1024034 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags. Low CVE-2017-5841 at SUSE CVE-2017-5841 at NVD SUSE bug 1023259 SUSE bug 1024030 SUSE bug 1024062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi. Low CVE-2017-5842 at SUSE CVE-2017-5842 at NVD SUSE bug 1023259 SUSE bug 1024041 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf. Low CVE-2017-5843 at SUSE CVE-2017-5843 at NVD SUSE bug 1023259 SUSE bug 1024044 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file. Low CVE-2017-5844 at SUSE CVE-2017-5844 at NVD SUSE bug 1023259 SUSE bug 1024079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag. Low CVE-2017-5845 at SUSE CVE-2017-5845 at NVD SUSE bug 1023259 SUSE bug 1024062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing. Low CVE-2017-5848 at SUSE CVE-2017-5848 at NVD SUSE bug 1023259 SUSE bug 1024068 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile. Low CVE-2017-5884 at SUSE CVE-2017-5884 at NVD SUSE bug 1024266 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow. Low CVE-2017-5885 at SUSE CVE-2017-5885 at NVD SUSE bug 1024268 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit. Moderate CVE-2017-5898 at SUSE CVE-2017-5898 at NVD SUSE bug 1023907 SUSE bug 1024307 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options. Moderate CVE-2017-5970 at SUSE CVE-2017-5970 at NVD SUSE bug 1024938 SUSE bug 1025013 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state. Moderate CVE-2017-5986 at SUSE CVE-2017-5986 at NVD SUSE bug 1025235 SUSE bug 1027066 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786. Moderate CVE-2017-6001 at SUSE CVE-2017-6001 at NVD SUSE bug 1015160 SUSE bug 1025626 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool. Moderate CVE-2017-6009 at SUSE CVE-2017-6009 at NVD SUSE bug 1025703 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash. Moderate CVE-2017-6010 at SUSE CVE-2017-6010 at NVD SUSE bug 1025700 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool. Moderate CVE-2017-6011 at SUSE CVE-2017-6011 at NVD SUSE bug 1025700 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request. Important CVE-2017-6059 at SUSE CVE-2017-6059 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call. Important CVE-2017-6074 at SUSE CVE-2017-6074 at NVD SUSE bug 1026024 SUSE bug 1072204 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag. Moderate CVE-2017-6214 at SUSE CVE-2017-6214 at NVD SUSE bug 1026722 SUSE bug 1027179 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic. Important CVE-2017-6413 at SUSE CVE-2017-6413 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device. Moderate CVE-2017-6462 at SUSE CVE-2017-6462 at NVD SUSE bug 1030050 SUSE bug 1038049 SUSE bug 1044525 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option. Moderate CVE-2017-6463 at SUSE CVE-2017-6463 at NVD SUSE bug 1030050 SUSE bug 1038049 SUSE bug 1044525 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive. Moderate CVE-2017-6464 at SUSE CVE-2017-6464 at NVD SUSE bug 1030050 SUSE bug 1038049 SUSE bug 1044525 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. Moderate CVE-2017-6519 at SUSE CVE-2017-6519 at NVD SUSE bug 1037001 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type. Low CVE-2017-6951 at SUSE CVE-2017-6951 at NVD SUSE bug 1029850 SUSE bug 1030593 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52. Moderate CVE-2017-7184 at SUSE CVE-2017-7184 at NVD SUSE bug 1030573 SUSE bug 1030575 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function. Moderate CVE-2017-7187 at SUSE CVE-2017-7187 at NVD SUSE bug 1027179 SUSE bug 1030213 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document. Low CVE-2017-7207 at SUSE CVE-2017-7207 at NVD SUSE bug 1030263 SUSE bug 1036453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device. Moderate CVE-2017-7294 at SUSE CVE-2017-7294 at NVD SUSE bug 1027179 SUSE bug 1031440 SUSE bug 1031481 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls. Moderate CVE-2017-7308 at SUSE CVE-2017-7308 at NVD SUSE bug 1027179 SUSE bug 1031579 SUSE bug 1031660 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server. Low CVE-2017-7392 at SUSE CVE-2017-7392 at NVD SUSE bug 1031886 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution. Moderate CVE-2017-7393 at SUSE CVE-2017-7393 at NVD SUSE bug 1031875 SUSE bug 1031879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames. Moderate CVE-2017-7394 at SUSE CVE-2017-7394 at NVD SUSE bug 1031879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server. Moderate CVE-2017-7395 at SUSE CVE-2017-7395 at NVD SUSE bug 1031877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server. Low CVE-2017-7396 at SUSE CVE-2017-7396 at NVD SUSE bug 1031886 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. Moderate CVE-2017-7472 at SUSE CVE-2017-7472 at NVD SUSE bug 1034862 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function. Moderate CVE-2017-7477 at SUSE CVE-2017-7477 at NVD SUSE bug 1035823 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. Moderate CVE-2017-7484 at SUSE CVE-2017-7484 at NVD SUSE bug 1037603 SUSE bug 1051015 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server. Moderate CVE-2017-7486 at SUSE CVE-2017-7486 at NVD SUSE bug 1037624 SUSE bug 1051015 SUSE bug 1051685 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information about existing usernames. Moderate CVE-2017-7488 at SUSE CVE-2017-7488 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. Important CVE-2017-7494 at SUSE CVE-2017-7494 at NVD SUSE bug 1038231 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker. Important CVE-2017-7502 at SUSE CVE-2017-7502 at NVD SUSE bug 1041603 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak. Important CVE-2017-7506 at SUSE CVE-2017-7506 at NVD SUSE bug 1046779 SUSE bug 1047730 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. Important CVE-2017-7507 at SUSE CVE-2017-7507 at NVD SUSE bug 1043398 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this. Moderate CVE-2017-7518 at SUSE CVE-2017-7518 at NVD SUSE bug 1045922 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions. Important CVE-2017-7533 at SUSE CVE-2017-7533 at NVD SUSE bug 1049483 SUSE bug 1050677 SUSE bug 1050751 SUSE bug 1053919 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates. Important CVE-2017-7537 at SUSE CVE-2017-7537 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet. Moderate CVE-2017-7541 at SUSE CVE-2017-7541 at NVD SUSE bug 1049645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. Moderate CVE-2017-7542 at SUSE CVE-2017-7542 at NVD SUSE bug 1049882 SUSE bug 1061936 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password. Moderate CVE-2017-7546 at SUSE CVE-2017-7546 at NVD SUSE bug 1051684 SUSE bug 1054365 SUSE bug 1140876 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. Moderate CVE-2017-7547 at SUSE CVE-2017-7547 at NVD SUSE bug 1051685 SUSE bug 1054365 SUSE bug 1140876 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution. Moderate CVE-2017-7555 at SUSE CVE-2017-7555 at NVD SUSE bug 1054171 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace. Moderate CVE-2017-7558 at SUSE CVE-2017-7558 at NVD SUSE bug 1053919 SUSE bug 1055300 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances. Moderate CVE-2017-7562 at SUSE CVE-2017-7562 at NVD SUSE bug 1055851 SUSE bug 1056995 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. Moderate CVE-2017-7616 at SUSE CVE-2017-7616 at NVD SUSE bug 1033336 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. Important CVE-2017-7645 at SUSE CVE-2017-7645 at NVD SUSE bug 1034670 SUSE bug 1036741 SUSE bug 1046191 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. Critical CVE-2017-7668 at SUSE CVE-2017-7668 at NVD SUSE bug 1045061 SUSE bug 1078450 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. Moderate CVE-2017-7674 at SUSE CVE-2017-7674 at NVD SUSE bug 1053352 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. Moderate CVE-2017-7679 at SUSE CVE-2017-7679 at NVD SUSE bug 1045060 SUSE bug 1057861 SUSE bug 1078450 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions. Moderate CVE-2017-7718 at SUSE CVE-2017-7718 at NVD SUSE bug 1034908 SUSE bug 1034994 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7749 at SUSE CVE-2017-7749 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7750 at SUSE CVE-2017-7750 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7751 at SUSE CVE-2017-7751 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7752 at SUSE CVE-2017-7752 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7753 at SUSE CVE-2017-7753 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7754 at SUSE CVE-2017-7754 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7756 at SUSE CVE-2017-7756 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7757 at SUSE CVE-2017-7757 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7758 at SUSE CVE-2017-7758 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54. Important CVE-2017-7762 at SUSE CVE-2017-7762 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7764 at SUSE CVE-2017-7764 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function. Important CVE-2017-7771 at SUSE CVE-2017-7771 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function. Important CVE-2017-7772 at SUSE CVE-2017-7772 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor. Important CVE-2017-7773 at SUSE CVE-2017-7773 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function. Important CVE-2017-7774 at SUSE CVE-2017-7774 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none Important CVE-2017-7775 at SUSE CVE-2017-7775 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph. Important CVE-2017-7776 at SUSE CVE-2017-7776 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function. Important CVE-2017-7777 at SUSE CVE-2017-7777 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Important CVE-2017-7778 at SUSE CVE-2017-7778 at NVD SUSE bug 1043960 SUSE bug 1044239 SUSE bug 1044240 SUSE bug 1044241 SUSE bug 1044242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7779 at SUSE CVE-2017-7779 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7784 at SUSE CVE-2017-7784 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7785 at SUSE CVE-2017-7785 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7786 at SUSE CVE-2017-7786 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7787 at SUSE CVE-2017-7787 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7791 at SUSE CVE-2017-7791 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7792 at SUSE CVE-2017-7792 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7793 at SUSE CVE-2017-7793 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55. Important CVE-2017-7798 at SUSE CVE-2017-7798 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7800 at SUSE CVE-2017-7800 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7801 at SUSE CVE-2017-7801 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7802 at SUSE CVE-2017-7802 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7803 at SUSE CVE-2017-7803 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7805 at SUSE CVE-2017-7805 at NVD SUSE bug 1060445 SUSE bug 1061005 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7807 at SUSE CVE-2017-7807 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55. Important CVE-2017-7809 at SUSE CVE-2017-7809 at NVD SUSE bug 1052829 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7810 at SUSE CVE-2017-7810 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7814 at SUSE CVE-2017-7814 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7818 at SUSE CVE-2017-7818 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7819 at SUSE CVE-2017-7819 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7823 at SUSE CVE-2017-7823 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Important CVE-2017-7824 at SUSE CVE-2017-7824 at NVD SUSE bug 1060445 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Moderate CVE-2017-7826 at SUSE CVE-2017-7826 at NVD SUSE bug 1068101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Moderate CVE-2017-7828 at SUSE CVE-2017-7828 at NVD SUSE bug 1068101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird < 52.5.2. Moderate CVE-2017-7829 at SUSE CVE-2017-7829 at NVD SUSE bug 1071236 SUSE bug 1074046 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Moderate CVE-2017-7830 at SUSE CVE-2017-7830 at NVD SUSE bug 1068101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1. Moderate CVE-2017-7843 at SUSE CVE-2017-7843 at NVD SUSE bug 1072034 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects Thunderbird < 52.5.2. Important CVE-2017-7846 at SUSE CVE-2017-7846 at NVD SUSE bug 1074043 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2. Moderate CVE-2017-7847 at SUSE CVE-2017-7847 at NVD SUSE bug 1074044 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2. Moderate CVE-2017-7848 at SUSE CVE-2017-7848 at NVD SUSE bug 1074045 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10. Critical CVE-2017-7869 at SUSE CVE-2017-7869 at NVD SUSE bug 1034173 SUSE bug 1038337 SUSE bug 1049210 SUSE bug 1149679 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c. Moderate CVE-2017-7889 at SUSE CVE-2017-7889 at NVD SUSE bug 1034405 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. Low CVE-2017-7890 at SUSE CVE-2017-7890 at NVD SUSE bug 1050241 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. Moderate CVE-2017-7895 at SUSE CVE-2017-7895 at NVD SUSE bug 1034670 SUSE bug 1036741 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation. Moderate CVE-2017-7980 at SUSE CVE-2017-7980 at NVD SUSE bug 1035406 SUSE bug 1035483 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. Moderate CVE-2017-8291 at SUSE CVE-2017-8291 at NVD SUSE bug 1036453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character. Moderate CVE-2017-8386 at SUSE CVE-2017-8386 at NVD SUSE bug 1038395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app. Important CVE-2017-8422 at SUSE CVE-2017-8422 at NVD SUSE bug 1033300 SUSE bug 1036244 SUSE bug 1041511 SUSE bug 749065 SUSE bug 869959 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb. Important CVE-2017-8779 at SUSE CVE-2017-8779 at NVD SUSE bug 1037559 SUSE bug 1037930 SUSE bug 1101814 SUSE bug 798028 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system. Important CVE-2017-8797 at SUSE CVE-2017-8797 at NVD SUSE bug 1046202 SUSE bug 1046206 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state. Important CVE-2017-8824 at SUSE CVE-2017-8824 at NVD SUSE bug 1070771 SUSE bug 1076734 SUSE bug 1092904 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. Important CVE-2017-8890 at SUSE CVE-2017-8890 at NVD SUSE bug 1038544 SUSE bug 1038564 SUSE bug 1039883 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1042364 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries. Moderate CVE-2017-8932 at SUSE CVE-2017-8932 at NVD SUSE bug 1040618 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Moderate CVE-2017-9074 at SUSE CVE-2017-9074 at NVD SUSE bug 1039882 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Moderate CVE-2017-9075 at SUSE CVE-2017-9075 at NVD SUSE bug 1038544 SUSE bug 1039883 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Moderate CVE-2017-9076 at SUSE CVE-2017-9076 at NVD SUSE bug 1038544 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1051906 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. Moderate CVE-2017-9077 at SUSE CVE-2017-9077 at NVD SUSE bug 1038544 SUSE bug 1040069 SUSE bug 1042364 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS. Important CVE-2017-9148 at SUSE CVE-2017-9148 at NVD SUSE bug 1041445 SUSE bug 1046141 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls. Important CVE-2017-9242 at SUSE CVE-2017-9242 at NVD SUSE bug 1041431 SUSE bug 1042892 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0. Moderate CVE-2017-9287 at SUSE CVE-2017-9287 at NVD SUSE bug 1041764 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks. Moderate CVE-2017-9461 at SUSE CVE-2017-9461 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. Important CVE-2017-9462 at SUSE CVE-2017-9462 at NVD SUSE bug 1043063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function. Moderate CVE-2017-9524 at SUSE CVE-2017-9524 at NVD SUSE bug 1043808 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail. Moderate CVE-2017-9725 at SUSE CVE-2017-9725 at NVD SUSE bug 1057481 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document. Moderate CVE-2017-9775 at SUSE CVE-2017-9775 at NVD SUSE bug 1045719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. Moderate CVE-2017-9776 at SUSE CVE-2017-9776 at NVD SUSE bug 1045721 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service. Moderate CVE-2017-9788 at SUSE CVE-2017-9788 at NVD SUSE bug 1048576 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c. Moderate CVE-2017-9798 at SUSE CVE-2017-9798 at NVD SUSE bug 1058058 SUSE bug 1060757 SUSE bug 1077582 SUSE bug 1078450 SUSE bug 1089997 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. Important CVE-2017-9800 at SUSE CVE-2017-9800 at NVD SUSE bug 1051362 SUSE bug 1052481 SUSE bug 1052696 SUSE bug 1052932 SUSE bug 1053364 SUSE bug 1054653 SUSE bug 1066430 SUSE bug 1071709 SUSE bug 1128150 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. Moderate CVE-2018-0494 at SUSE CVE-2018-0494 at NVD SUSE bug 1092061 SUSE bug 1123797 SUSE bug 1159418 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. Moderate CVE-2018-0495 at SUSE CVE-2018-0495 at NVD SUSE bug 1097410 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Moderate CVE-2018-0618 at SUSE CVE-2018-0618 at NVD SUSE bug 1099510 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o). Moderate CVE-2018-0732 at SUSE CVE-2018-0732 at NVD SUSE bug 1077628 SUSE bug 1087102 SUSE bug 1097158 SUSE bug 1099502 SUSE bug 1106692 SUSE bug 1108542 SUSE bug 1110163 SUSE bug 1112097 SUSE bug 1122198 SUSE bug 1148697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). Moderate CVE-2018-0734 at SUSE CVE-2018-0734 at NVD SUSE bug 1113534 SUSE bug 1113652 SUSE bug 1113742 SUSE bug 1122198 SUSE bug 1122212 SUSE bug 1126909 SUSE bug 1148697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). Moderate CVE-2018-0737 at SUSE CVE-2018-0737 at NVD SUSE bug 1089039 SUSE bug 1089041 SUSE bug 1089044 SUSE bug 1089045 SUSE bug 1108542 SUSE bug 1123780 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). Moderate CVE-2018-0739 at SUSE CVE-2018-0739 at NVD SUSE bug 1087102 SUSE bug 1089997 SUSE bug 1094291 SUSE bug 1108542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Important CVE-2018-1000001 at SUSE CVE-2018-1000001 at NVD SUSE bug 1074293 SUSE bug 1099047 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition. Moderate CVE-2018-1000004 at SUSE CVE-2018-1000004 at NVD SUSE bug 1076017 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. Moderate CVE-2018-1000007 at SUSE CVE-2018-1000007 at NVD SUSE bug 1077001 SUSE bug 1145903 SUSE bug 1185551 SUSE bug 1192797 SUSE bug 1198766 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later. Moderate CVE-2018-1000024 at SUSE CVE-2018-1000024 at NVD SUSE bug 1077003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM.. Important CVE-2018-1000026 at SUSE CVE-2018-1000026 at NVD SUSE bug 1079384 SUSE bug 1087082 SUSE bug 1096723 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later. Moderate CVE-2018-1000027 at SUSE CVE-2018-1000027 at NVD SUSE bug 1077006 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. Moderate CVE-2018-1000073 at SUSE CVE-2018-1000073 at NVD SUSE bug 1082007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. Important CVE-2018-1000074 at SUSE CVE-2018-1000074 at NVD SUSE bug 1082008 SUSE bug 1175764 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. Low CVE-2018-1000075 at SUSE CVE-2018-1000075 at NVD SUSE bug 1082014 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. Moderate CVE-2018-1000076 at SUSE CVE-2018-1000076 at NVD SUSE bug 1082009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. Moderate CVE-2018-1000077 at SUSE CVE-2018-1000077 at NVD SUSE bug 1082010 SUSE bug 1183937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. Moderate CVE-2018-1000078 at SUSE CVE-2018-1000078 at NVD SUSE bug 1082011 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. Moderate CVE-2018-1000079 at SUSE CVE-2018-1000079 at NVD SUSE bug 1082058 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0. Moderate CVE-2018-1000119 at SUSE CVE-2018-1000119 at NVD SUSE bug 1084436 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. Moderate CVE-2018-1000120 at SUSE CVE-2018-1000120 at NVD SUSE bug 1084521 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service Low CVE-2018-1000121 at SUSE CVE-2018-1000121 at NVD SUSE bug 1084524 SUSE bug 1085215 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Moderate CVE-2018-1000122 at SUSE CVE-2018-1000122 at NVD SUSE bug 1084532 SUSE bug 1101811 SUSE bug 1112526 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1. Moderate CVE-2018-1000132 at SUSE CVE-2018-1000132 at NVD SUSE bug 1085211 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. Critical CVE-2018-1000140 at SUSE CVE-2018-1000140 at NVD SUSE bug 1086730 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time. Moderate CVE-2018-1000156 at SUSE CVE-2018-1000156 at NVD SUSE bug 1088420 SUSE bug 1093615 SUSE bug 1101128 SUSE bug 1142513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f. Important CVE-2018-1000199 at SUSE CVE-2018-1000199 at NVD SUSE bug 1089895 SUSE bug 1090036 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0. Critical CVE-2018-1000301 at SUSE CVE-2018-1000301 at NVD SUSE bug 1092098 SUSE bug 1122464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1 Moderate CVE-2018-1000801 at SUSE CVE-2018-1000801 at NVD SUSE bug 1107591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. Critical CVE-2018-1000805 at SUSE CVE-2018-1000805 at NVD SUSE bug 1111151 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3. Moderate CVE-2018-1000852 at SUSE CVE-2018-1000852 at NVD SUSE bug 1117963 SUSE bug 1120507 SUSE bug 1131873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. Moderate CVE-2018-1000876 at SUSE CVE-2018-1000876 at NVD SUSE bug 1120640 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. Low CVE-2018-1000877 at SUSE CVE-2018-1000877 at NVD SUSE bug 1120653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive. Moderate CVE-2018-1000878 at SUSE CVE-2018-1000878 at NVD SUSE bug 1120654 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'. Moderate CVE-2018-1002200 at SUSE CVE-2018-1002200 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file. Moderate CVE-2018-10177 at SUSE CVE-2018-10177 at NVD SUSE bug 1089781 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. Moderate CVE-2018-10194 at SUSE CVE-2018-10194 at NVD SUSE bug 1090099 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image. Moderate CVE-2018-10322 at SUSE CVE-2018-10322 at NVD SUSE bug 1087082 SUSE bug 1090749 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. Low CVE-2018-10360 at SUSE CVE-2018-10360 at NVD SUSE bug 1096974 SUSE bug 1096984 SUSE bug 1126118 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf. Low CVE-2018-10372 at SUSE CVE-2018-10372 at NVD SUSE bug 1091015 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new. Low CVE-2018-10373 at SUSE CVE-2018-10373 at NVD SUSE bug 1090997 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted. Moderate CVE-2018-1049 at SUSE CVE-2018-1049 at NVD SUSE bug 1076308 SUSE bug 1140475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. Moderate CVE-2018-1050 at SUSE CVE-2018-1050 at NVD SUSE bug 1081741 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. Moderate CVE-2018-10534 at SUSE CVE-2018-10534 at NVD SUSE bug 1091368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy. Low CVE-2018-10535 at SUSE CVE-2018-10535 at NVD SUSE bug 1091365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service. Important CVE-2018-1054 at SUSE CVE-2018-1054 at NVD SUSE bug 1083689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712. Moderate CVE-2018-10547 at SUSE CVE-2018-10547 at NVD SUSE bug 1091362 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable. Moderate CVE-2018-1059 at SUSE CVE-2018-1059 at NVD SUSE bug 1089638 SUSE bug 1090647 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. Low CVE-2018-1060 at SUSE CVE-2018-1060 at NVD SUSE bug 1088009 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service. Low CVE-2018-1061 at SUSE CVE-2018-1061 at NVD SUSE bug 1088004 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11. Moderate CVE-2018-1063 at SUSE CVE-2018-1063 at NVD SUSE bug 1083624 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. Moderate CVE-2018-1064 at SUSE CVE-2018-1064 at NVD SUSE bug 1076500 SUSE bug 1083625 SUSE bug 1087887 SUSE bug 1088147 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls. Moderate CVE-2018-10675 at SUSE CVE-2018-10675 at NVD SUSE bug 1087082 SUSE bug 1091755 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. Important CVE-2018-1068 at SUSE CVE-2018-1068 at NVD SUSE bug 1085107 SUSE bug 1085114 SUSE bug 1087082 SUSE bug 1123903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file. Moderate CVE-2018-10689 at SUSE CVE-2018-10689 at NVD SUSE bug 1091942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service. Low CVE-2018-1071 at SUSE CVE-2018-1071 at NVD SUSE bug 1084656 SUSE bug 1200039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack. Moderate CVE-2018-10733 at SUSE CVE-2018-10733 at NVD SUSE bug 1092125 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack. Moderate CVE-2018-10767 at SUSE CVE-2018-10767 at NVD SUSE bug 1092123 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected. Low CVE-2018-10768 at SUSE CVE-2018-10768 at NVD SUSE bug 1092105 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file. Low CVE-2018-10772 at SUSE CVE-2018-10772 at NVD SUSE bug 1092096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a heap-based buffer over-read, as demonstrated by bmp2tiff. Low CVE-2018-10779 at SUSE CVE-2018-10779 at NVD SUSE bug 1092480 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process. Important CVE-2018-1079 at SUSE CVE-2018-1079 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences. Important CVE-2018-1080 at SUSE CVE-2018-1080 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. Low CVE-2018-10804 at SUSE CVE-2018-10804 at NVD SUSE bug 1095813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. Low CVE-2018-10805 at SUSE CVE-2018-10805 at NVD SUSE bug 1095812 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation. Moderate CVE-2018-1083 at SUSE CVE-2018-1083 at NVD SUSE bug 1087026 SUSE bug 1189668 SUSE bug 1200209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c. Important CVE-2018-1084 at SUSE CVE-2018-1084 at NVD SUSE bug 1089346 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. Moderate CVE-2018-10844 at SUSE CVE-2018-10844 at NVD SUSE bug 1105437 SUSE bug 1105459 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets. Moderate CVE-2018-10845 at SUSE CVE-2018-10845 at NVD SUSE bug 1105437 SUSE bug 1105459 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets. Moderate CVE-2018-10846 at SUSE CVE-2018-10846 at NVD SUSE bug 1105460 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service. Moderate CVE-2018-10850 at SUSE CVE-2018-10850 at NVD SUSE bug 1096368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. Moderate CVE-2018-10852 at SUSE CVE-2018-10852 at NVD SUSE bug 1098377 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. Important CVE-2018-10853 at SUSE CVE-2018-10853 at NVD SUSE bug 1097104 SUSE bug 1097108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable. Moderate CVE-2018-10858 at SUSE CVE-2018-10858 at NVD SUSE bug 1103411 SUSE bug 1110943 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege. Important CVE-2018-1086 at SUSE CVE-2018-1086 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest. Important CVE-2018-1087 at SUSE CVE-2018-1087 at NVD SUSE bug 1087088 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. Important CVE-2018-10873 at SUSE CVE-2018-10873 at NVD SUSE bug 1104448 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image. Moderate CVE-2018-10878 at SUSE CVE-2018-10878 at NVD SUSE bug 1087082 SUSE bug 1099813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image. Moderate CVE-2018-10879 at SUSE CVE-2018-10879 at NVD SUSE bug 1087082 SUSE bug 1099844 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. Moderate CVE-2018-10881 at SUSE CVE-2018-10881 at NVD SUSE bug 1087082 SUSE bug 1099864 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. Moderate CVE-2018-10883 at SUSE CVE-2018-10883 at NVD SUSE bug 1087082 SUSE bug 1099863 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service. Important CVE-2018-1089 at SUSE CVE-2018-1089 at NVD SUSE bug 1092187 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. Moderate CVE-2018-10893 at SUSE CVE-2018-10893 at NVD SUSE bug 1101295 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks. Important CVE-2018-10896 at SUSE CVE-2018-10896 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected. Important CVE-2018-10897 at SUSE CVE-2018-10897 at NVD SUSE bug 1100972 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. Low CVE-2018-10902 at SUSE CVE-2018-10902 at NVD SUSE bug 1105322 SUSE bug 1105323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects. Moderate CVE-2018-10906 at SUSE CVE-2018-10906 at NVD SUSE bug 1101797 SUSE bug 1127346 SUSE bug 1127350 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service. Low CVE-2018-1091 at SUSE CVE-2018-1091 at NVD SUSE bug 1087231 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable. Low CVE-2018-10910 at SUSE CVE-2018-10910 at NVD SUSE bug 1102238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value. Moderate CVE-2018-10911 at SUSE CVE-2018-10911 at NVD SUSE bug 1105776 SUSE bug 1107020 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected. Important CVE-2018-10915 at SUSE CVE-2018-10915 at NVD SUSE bug 1104199 SUSE bug 1140876 SUSE bug 1185814 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. Moderate CVE-2018-10916 at SUSE CVE-2018-10916 at NVD SUSE bug 1103367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. Moderate CVE-2018-1092 at SUSE CVE-2018-1092 at NVD SUSE bug 1087012 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. Moderate CVE-2018-10935 at SUSE CVE-2018-10935 at NVD SUSE bug 1105606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image. Low CVE-2018-1094 at SUSE CVE-2018-1094 at NVD SUSE bug 1087007 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory. Moderate CVE-2018-10940 at SUSE CVE-2018-10940 at NVD SUSE bug 1087082 SUSE bug 1092903 SUSE bug 1107689 SUSE bug 1113751 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call. Low CVE-2018-10958 at SUSE CVE-2018-10958 at NVD SUSE bug 1092952 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file, a different vulnerability than CVE-2017-13726. Moderate CVE-2018-10963 at SUSE CVE-2018-10963 at NVD SUSE bug 1092949 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call. Moderate CVE-2018-10998 at SUSE CVE-2018-10998 at NVD SUSE bug 1093095 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user. Important CVE-2018-1100 at SUSE CVE-2018-1100 at NVD SUSE bug 1089030 SUSE bug 1189668 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. Moderate CVE-2018-11037 at SUSE CVE-2018-11037 at NVD SUSE bug 1093475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system. Moderate CVE-2018-1106 at SUSE CVE-2018-1106 at NVD SUSE bug 1086936 SUSE bug 1123722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. Important CVE-2018-1111 at SUSE CVE-2018-1111 at NVD SUSE bug 1093364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system. Moderate CVE-2018-1113 at SUSE CVE-2018-1113 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. Low CVE-2018-1116 at SUSE CVE-2018-1116 at NVD SUSE bug 1099031 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. Low CVE-2018-1118 at SUSE CVE-2018-1118 at NVD SUSE bug 1087082 SUSE bug 1092472 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks). Moderate CVE-2018-1120 at SUSE CVE-2018-1120 at NVD SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file. Low CVE-2018-11212 at SUSE CVE-2018-11212 at NVD SUSE bug 1122299 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file. Moderate CVE-2018-11213 at SUSE CVE-2018-11213 at NVD SUSE bug 1160884 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file. Moderate CVE-2018-11214 at SUSE CVE-2018-11214 at NVD SUSE bug 1160884 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function. CVE-2018-1122 at SUSE CVE-2018-1122 at NVD SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. Important CVE-2018-11235 at SUSE CVE-2018-11235 at NVD SUSE bug 1095219 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution. Important CVE-2018-11236 at SUSE CVE-2018-11236 at NVD SUSE bug 1094161 SUSE bug 1110160 SUSE bug 1118435 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper. Moderate CVE-2018-11237 at SUSE CVE-2018-11237 at NVD SUSE bug 1092877 SUSE bug 1094154 SUSE bug 1118435 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users. CVE-2018-1124 at SUSE CVE-2018-1124 at NVD SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124. CVE-2018-1126 at SUSE CVE-2018-1126 at NVD SUSE bug 1087082 SUSE bug 1092100 SUSE bug 1093158 SUSE bug 1123135 SUSE bug 1126909 SUSE bug 1128955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls. Low CVE-2018-1130 at SUSE CVE-2018-1130 at NVD SUSE bug 1092904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character. Moderate CVE-2018-11362 at SUSE CVE-2018-11362 at NVD SUSE bug 1094301 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. Moderate CVE-2018-1139 at SUSE CVE-2018-1139 at NVD SUSE bug 1095048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file. Low CVE-2018-11439 at SUSE CVE-2018-11439 at NVD SUSE bug 1096180 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977. Moderate CVE-2018-11645 at SUSE CVE-2018-11645 at NVD SUSE bug 1095610 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file. Moderate CVE-2018-11656 at SUSE CVE-2018-11656 at NVD SUSE bug 1095726 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections. Moderate CVE-2018-11712 at SUSE CVE-2018-11712 at NVD SUSE bug 1096061 SUSE bug 1097693 SUSE Liberty Linux 7 LTSS WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection. Moderate CVE-2018-11713 at SUSE CVE-2018-11713 at NVD SUSE bug 1096060 SUSE bug 1097693 SUSE Liberty Linux 7 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. Important CVE-2018-11781 at SUSE CVE-2018-11781 at NVD SUSE bug 1108748 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server. Moderate CVE-2018-11782 at SUSE CVE-2018-11782 at NVD SUSE bug 1142743 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. Moderate CVE-2018-11784 at SUSE CVE-2018-11784 at NVD SUSE bug 1110850 SUSE bug 1122212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. Moderate CVE-2018-11806 at SUSE CVE-2018-11806 at NVD SUSE bug 1096223 SUSE bug 1096224 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. Moderate CVE-2018-11813 at SUSE CVE-2018-11813 at NVD SUSE bug 1096209 SUSE bug 1172994 SUSE bug 1172995 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name. Low CVE-2018-12015 at SUSE CVE-2018-12015 at NVD SUSE bug 1096718 SUSE bug 1099497 SUSE bug 1099507 SUSE bug 1106717 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes. Important CVE-2018-12020 at SUSE CVE-2018-12020 at NVD SUSE bug 1096745 SUSE bug 1101134 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer. Moderate CVE-2018-12121 at SUSE CVE-2018-12121 at NVD SUSE bug 1117626 SUSE bug 1127532 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12126 at SUSE CVE-2018-12126 at NVD SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1135524 SUSE bug 1137916 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1149725 SUSE bug 1149726 SUSE bug 1149729 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12127 at SUSE CVE-2018-12127 at NVD SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2018-12130 at SUSE CVE-2018-12130 at NVD SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1135409 SUSE bug 1137916 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access. Important CVE-2018-12180 at SUSE CVE-2018-12180 at NVD SUSE bug 1127820 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access. Moderate CVE-2018-12181 at SUSE CVE-2018-12181 at NVD SUSE bug 1128503 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. Moderate CVE-2018-12207 at SUSE CVE-2018-12207 at NVD SUSE bug 1117665 SUSE bug 1139073 SUSE bug 1152505 SUSE bug 1155812 SUSE bug 1155817 SUSE bug 1155945 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. Low CVE-2018-12264 at SUSE CVE-2018-12264 at NVD SUSE bug 1097600 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. Low CVE-2018-12265 at SUSE CVE-2018-12265 at NVD SUSE bug 1097599 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source. Low CVE-2018-12327 at SUSE CVE-2018-12327 at NVD SUSE bug 1098531 SUSE bug 1107887 SUSE bug 1111552 SUSE bug 1111853 SUSE bug 1155513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12359 at SUSE CVE-2018-12359 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12360 at SUSE CVE-2018-12360 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12362 at SUSE CVE-2018-12362 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12363 at SUSE CVE-2018-12363 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12364 at SUSE CVE-2018-12364 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12365 at SUSE CVE-2018-12365 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-12366 at SUSE CVE-2018-12366 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9. Moderate CVE-2018-12372 at SUSE CVE-2018-12372 at NVD SUSE bug 1100082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9. Moderate CVE-2018-12373 at SUSE CVE-2018-12373 at NVD SUSE bug 1100079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9. Moderate CVE-2018-12374 at SUSE CVE-2018-12374 at NVD SUSE bug 1100081 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Moderate CVE-2018-12376 at SUSE CVE-2018-12376 at NVD SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Moderate CVE-2018-12377 at SUSE CVE-2018-12377 at NVD SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Moderate CVE-2018-12378 at SUSE CVE-2018-12378 at NVD SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Moderate CVE-2018-12379 at SUSE CVE-2018-12379 at NVD SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1. Moderate CVE-2018-12383 at SUSE CVE-2018-12383 at NVD SUSE bug 1107343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3. Moderate CVE-2018-12384 at SUSE CVE-2018-12384 at NVD SUSE bug 1106873 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2. Moderate CVE-2018-12385 at SUSE CVE-2018-12385 at NVD SUSE bug 1109363 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3. Important CVE-2018-12386 at SUSE CVE-2018-12386 at NVD SUSE bug 1110506 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3. Important CVE-2018-12387 at SUSE CVE-2018-12387 at NVD SUSE bug 1110507 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3. Important CVE-2018-12389 at SUSE CVE-2018-12389 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3. Important CVE-2018-12390 at SUSE CVE-2018-12390 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3. Important CVE-2018-12392 at SUSE CVE-2018-12392 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3. Important CVE-2018-12393 at SUSE CVE-2018-12393 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63. Important CVE-2018-12395 at SUSE CVE-2018-12395 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63. Important CVE-2018-12396 at SUSE CVE-2018-12396 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63. Important CVE-2018-12397 at SUSE CVE-2018-12397 at NVD SUSE bug 1112852 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41. Moderate CVE-2018-12404 at SUSE CVE-2018-12404 at NVD SUSE bug 1119069 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Moderate CVE-2018-12405 at SUSE CVE-2018-12405 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. Moderate CVE-2018-12599 at SUSE CVE-2018-12599 at NVD SUSE bug 1098546 SUSE bug 1117463 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. Moderate CVE-2018-12600 at SUSE CVE-2018-12600 at NVD SUSE bug 1098545 SUSE bug 1098546 SUSE bug 1117463 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new. Low CVE-2018-12641 at SUSE CVE-2018-12641 at NVD SUSE bug 1098937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump. Low CVE-2018-12697 at SUSE CVE-2018-12697 at NVD SUSE bug 1098940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. Important CVE-2018-1283 at SUSE CVE-2018-1283 at NVD SUSE bug 1086814 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via a crafted TIFF file. Moderate CVE-2018-12900 at SUSE CVE-2018-12900 at NVD SUSE bug 1099257 SUSE bug 1125113 SUSE bug 1150480 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. Low CVE-2018-12910 at SUSE CVE-2018-12910 at NVD SUSE bug 1100097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage. Important CVE-2018-1301 at SUSE CVE-2018-1301 at NVD SUSE bug 1086817 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability. Important CVE-2018-1303 at SUSE CVE-2018-1303 at NVD SUSE bug 1086813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm. Moderate CVE-2018-13033 at SUSE CVE-2018-13033 at NVD SUSE bug 1099929 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected. Moderate CVE-2018-1304 at SUSE CVE-2018-1304 at NVD SUSE bug 1082480 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. Moderate CVE-2018-1305 at SUSE CVE-2018-1305 at NVD SUSE bug 1082481 SUSE bug 1112097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. Low CVE-2018-13053 at SUSE CVE-2018-13053 at NVD SUSE bug 1099924 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation. Moderate CVE-2018-13093 at SUSE CVE-2018-13093 at NVD SUSE bug 1100001 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. Moderate CVE-2018-13094 at SUSE CVE-2018-13094 at NVD SUSE bug 1087082 SUSE bug 1100000 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork. Moderate CVE-2018-13095 at SUSE CVE-2018-13095 at NVD SUSE bug 1099999 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. Important CVE-2018-1311 at SUSE CVE-2018-1311 at NVD SUSE bug 1159552 SUSE bug 1221037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. Moderate CVE-2018-1312 at SUSE CVE-2018-1312 at NVD SUSE bug 1086775 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. Important CVE-2018-13139 at SUSE CVE-2018-13139 at NVD SUSE bug 1100167 SUSE bug 1116993 SUSE bug 1211493 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c. Moderate CVE-2018-13153 at SUSE CVE-2018-13153 at NVD SUSE bug 1100175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one. Important CVE-2018-13259 at SUSE CVE-2018-13259 at NVD SUSE bug 1107294 SUSE bug 1194009 SUSE bug 1194012 SUSE bug 1200039 SUSE bug 1200209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004. Moderate CVE-2018-13346 at SUSE CVE-2018-13346 at NVD SUSE bug 1100354 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. Moderate CVE-2018-13347 at SUSE CVE-2018-13347 at NVD SUSE bug 1100355 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. Moderate CVE-2018-1336 at SUSE CVE-2018-1336 at NVD SUSE bug 1102400 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. Moderate CVE-2018-13405 at SUSE CVE-2018-13405 at NVD SUSE bug 1087082 SUSE bug 1100416 SUSE bug 1129735 SUSE bug 1195161 SUSE bug 1198702 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert. Low CVE-2018-13440 at SUSE CVE-2018-13440 at NVD SUSE bug 1100523 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. Moderate CVE-2018-13796 at SUSE CVE-2018-13796 at NVD SUSE bug 1101288 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file. Moderate CVE-2018-13988 at SUSE CVE-2018-13988 at NVD SUSE bug 1102531 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c. Low CVE-2018-14036 at SUSE CVE-2018-14036 at NVD SUSE bug 1099699 SUSE bug 1101332 SUSE bug 1112694 SUSE Liberty Linux 7 In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. Moderate CVE-2018-14040 at SUSE CVE-2018-14040 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. Moderate CVE-2018-14042 at SUSE CVE-2018-14042 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp. Low CVE-2018-14046 at SUSE CVE-2018-14046 at NVD SUSE bug 1101339 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read. Low CVE-2018-14340 at SUSE CVE-2018-14340 at NVD SUSE bug 1101804 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow. Low CVE-2018-14341 at SUSE CVE-2018-14341 at NVD SUSE bug 1101776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information. Moderate CVE-2018-14348 at SUSE CVE-2018-14348 at NVD SUSE bug 1100365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription. Critical CVE-2018-14354 at SUSE CVE-2018-14354 at NVD SUSE bug 1101428 SUSE bug 1101578 SUSE bug 1101581 SUSE bug 1101589 SUSE bug 1101593 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. Moderate CVE-2018-14355 at SUSE CVE-2018-14355 at NVD SUSE bug 1101428 SUSE bug 1101577 SUSE bug 1101593 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription. Important CVE-2018-14357 at SUSE CVE-2018-14357 at NVD SUSE bug 1101428 SUSE bug 1101573 SUSE bug 1101581 SUSE bug 1101589 SUSE bug 1101593 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character. Moderate CVE-2018-14362 at SUSE CVE-2018-14362 at NVD SUSE bug 1101428 SUSE bug 1101567 SUSE bug 1101589 SUSE bug 1101593 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long. Low CVE-2018-14368 at SUSE CVE-2018-14368 at NVD SUSE bug 1101794 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. Moderate CVE-2018-14404 at SUSE CVE-2018-14404 at NVD SUSE bug 1102046 SUSE bug 1148896 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. Low CVE-2018-14434 at SUSE CVE-2018-14434 at NVD SUSE bug 1102003 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. Low CVE-2018-14435 at SUSE CVE-2018-14435 at NVD SUSE bug 1102007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. Low CVE-2018-14436 at SUSE CVE-2018-14436 at NVD SUSE bug 1102005 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. Low CVE-2018-14437 at SUSE CVE-2018-14437 at NVD SUSE bug 1102004 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries. Low CVE-2018-14498 at SUSE CVE-2018-14498 at NVD SUSE bug 1128712 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information. Moderate CVE-2018-14526 at SUSE CVE-2018-14526 at NVD SUSE bug 1104205 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251. Moderate CVE-2018-14567 at SUSE CVE-2018-14567 at NVD SUSE bug 1088279 SUSE bug 1088601 SUSE bug 1105166 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault). Moderate CVE-2018-14598 at SUSE CVE-2018-14598 at NVD SUSE bug 1102073 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact. Moderate CVE-2018-14599 at SUSE CVE-2018-14599 at NVD SUSE bug 1102062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution. Important CVE-2018-14600 at SUSE CVE-2018-14600 at NVD SUSE bug 1102068 SUSE bug 1178417 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.) Moderate CVE-2018-14618 at SUSE CVE-2018-14618 at NVD SUSE bug 1106019 SUSE bug 1112758 SUSE bug 1122464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash. Important CVE-2018-14624 at SUSE CVE-2018-14624 at NVD SUSE bug 1106699 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients. Moderate CVE-2018-14625 at SUSE CVE-2018-14625 at NVD SUSE bug 1106615 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. Moderate CVE-2018-14633 at SUSE CVE-2018-14633 at NVD SUSE bug 1107829 SUSE bug 1107832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. Moderate CVE-2018-14634 at SUSE CVE-2018-14634 at NVD SUSE bug 1108912 SUSE bug 1108963 SUSE bug 1115893 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service. Important CVE-2018-14638 at SUSE CVE-2018-14638 at NVD SUSE bug 1108674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service. Moderate CVE-2018-14646 at SUSE CVE-2018-14646 at NVD SUSE bug 1117290 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15. Moderate CVE-2018-14647 at SUSE CVE-2018-14647 at NVD SUSE bug 1109847 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service. Important CVE-2018-14648 at SUSE CVE-2018-14648 at NVD SUSE bug 1109609 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory. Moderate CVE-2018-14650 at SUSE CVE-2018-14650 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges. Important CVE-2018-14665 at SUSE CVE-2018-14665 at NVD SUSE bug 1111697 SUSE bug 1112020 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash). Low CVE-2018-14679 at SUSE CVE-2018-14679 at NVD SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. Low CVE-2018-14680 at SUSE CVE-2018-14680 at NVD SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite. Low CVE-2018-14681 at SUSE CVE-2018-14681 at NVD SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Low CVE-2018-14682 at SUSE CVE-2018-14682 at NVD SUSE bug 1102922 SUSE bug 1103032 SUSE bug 1103040 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free). Low CVE-2018-14734 at SUSE CVE-2018-14734 at NVD SUSE bug 1103119 SUSE bug 1131390 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution Critical CVE-2018-15127 at SUSE CVE-2018-15127 at NVD SUSE bug 1120117 SUSE bug 1123828 SUSE bug 1123832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. Moderate CVE-2018-15473 at SUSE CVE-2018-15473 at NVD SUSE bug 1105010 SUSE bug 1106163 SUSE bug 1123133 SUSE bug 1138392 SUSE bug 1205621 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. Low CVE-2018-15518 at SUSE CVE-2018-15518 at NVD SUSE bug 1118595 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. Moderate CVE-2018-15587 at SUSE CVE-2018-15587 at NVD SUSE bug 1125230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. Moderate CVE-2018-15594 at SUSE CVE-2018-15594 at NVD SUSE bug 1105348 SUSE bug 1133319 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Moderate CVE-2018-15607 at SUSE CVE-2018-15607 at NVD SUSE bug 1105594 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. Moderate CVE-2018-15686 at SUSE CVE-2018-15686 at NVD SUSE bug 1113665 SUSE bug 1120323 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239. Important CVE-2018-15688 at SUSE CVE-2018-15688 at NVD SUSE bug 1113632 SUSE bug 1113668 SUSE bug 1113669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread. Moderate CVE-2018-15746 at SUSE CVE-2018-15746 at NVD SUSE bug 1106222 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by supplying a crafted keymap file that triggers boolean negation. Low CVE-2018-15853 at SUSE CVE-2018-15853 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because geometry tokens were desupported incorrectly. Low CVE-2018-15854 at SUSE CVE-2018-15854 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in xkbcommon before 0.8.1 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because the XkbFile for an xkb_geometry section was mishandled. Low CVE-2018-15855 at SUSE CVE-2018-15855 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An infinite loop when reaching EOL unexpectedly in compose/parser.c (aka the keymap parser) in xkbcommon before 0.8.1 could be used by local attackers to cause a denial of service during parsing of crafted keymap files. Low CVE-2018-15856 at SUSE CVE-2018-15856 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An invalid free in ExprAppendMultiKeysymList in xkbcomp/ast-build.c in xkbcommon before 0.8.1 could be used by local attackers to crash xkbcommon keymap parsers or possibly have unspecified other impact by supplying a crafted keymap file. Low CVE-2018-15857 at SUSE CVE-2018-15857 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage when parsing invalid atoms in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because lookup failures are mishandled. Low CVE-2018-15859 at SUSE CVE-2018-15859 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure. Low CVE-2018-15861 at SUSE CVE-2018-15861 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in LookupModMask in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with invalid virtual modifiers. Low CVE-2018-15862 at SUSE CVE-2018-15862 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in ResolveStateAndPredicate in xkbcomp/compat.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file with a no-op modmask expression. Low CVE-2018-15863 at SUSE CVE-2018-15863 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unchecked NULL pointer usage in resolve_keysym in xkbcomp/parser.y in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file, because a map access attempt can occur for a map that was never created. Low CVE-2018-15864 at SUSE CVE-2018-15864 at NVD SUSE bug 1105832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files. Moderate CVE-2018-15908 at SUSE CVE-2018-15908 at NVD SUSE bug 1105464 SUSE bug 1106171 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code. Moderate CVE-2018-15909 at SUSE CVE-2018-15909 at NVD SUSE bug 1105464 SUSE bug 1106172 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code. Moderate CVE-2018-15910 at SUSE CVE-2018-15910 at NVD SUSE bug 1105464 SUSE bug 1106173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code. Moderate CVE-2018-15911 at SUSE CVE-2018-15911 at NVD SUSE bug 1105464 SUSE bug 1106195 SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations. Important CVE-2018-16057 at SUSE CVE-2018-16057 at NVD SUSE bug 1106514 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Moderate CVE-2018-16062 at SUSE CVE-2018-16062 at NVD SUSE bug 1106390 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c. Low CVE-2018-16328 at SUSE CVE-2018-16328 at NVD SUSE bug 1106857 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16391 at SUSE CVE-2018-16391 at NVD SUSE bug 1106998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16392 at SUSE CVE-2018-16392 at NVD SUSE bug 1106999 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16393 at SUSE CVE-2018-16393 at NVD SUSE bug 1108318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations. Moderate CVE-2018-16395 at SUSE CVE-2018-16395 at NVD SUSE bug 1112530 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. Moderate CVE-2018-16396 at SUSE CVE-2018-16396 at NVD SUSE bug 1112532 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice. Moderate CVE-2018-16402 at SUSE CVE-2018-16402 at NVD SUSE bug 1107066 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash. Low CVE-2018-16403 at SUSE CVE-2018-16403 at NVD SUSE bug 1107067 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16418 at SUSE CVE-2018-16418 at NVD SUSE bug 1107039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16419 at SUSE CVE-2018-16419 at NVD SUSE bug 1107107 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16420 at SUSE CVE-2018-16420 at NVD SUSE bug 1107097 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16421 at SUSE CVE-2018-16421 at NVD SUSE bug 1107049 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16422 at SUSE CVE-2018-16422 at NVD SUSE bug 1107038 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact. Moderate CVE-2018-16423 at SUSE CVE-2018-16423 at NVD SUSE bug 1107037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs. Moderate CVE-2018-16426 at SUSE CVE-2018-16426 at NVD SUSE bug 1107034 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs. Moderate CVE-2018-16427 at SUSE CVE-2018-16427 at NVD SUSE bug 1107033 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. Moderate CVE-2018-16509 at SUSE CVE-2018-16509 at NVD SUSE bug 1107410 SUSE bug 1108027 SUSE bug 1118318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Moderate CVE-2018-16511 at SUSE CVE-2018-16511 at NVD SUSE bug 1107426 SUSE bug 1111479 SUSE bug 1112229 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable. Moderate CVE-2018-16539 at SUSE CVE-2018-16539 at NVD SUSE bug 1107422 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact. Moderate CVE-2018-16540 at SUSE CVE-2018-16540 at NVD SUSE bug 1107420 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter. Moderate CVE-2018-16541 at SUSE CVE-2018-16541 at NVD SUSE bug 1107421 SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter. Moderate CVE-2018-16542 at SUSE CVE-2018-16542 at NVD SUSE bug 1107413 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack. Low CVE-2018-16548 at SUSE CVE-2018-16548 at NVD SUSE bug 1107424 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c. Low CVE-2018-16640 at SUSE CVE-2018-16640 at NVD SUSE bug 1107619 SUSE Liberty Linux 7 LTSS The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write. Moderate CVE-2018-16642 at SUSE CVE-2018-16642 at NVD SUSE bug 1107616 SUSE Liberty Linux 7 LTSS The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file. Low CVE-2018-16643 at SUSE CVE-2018-16643 at NVD SUSE bug 1107612 SUSE Liberty Linux 7 LTSS There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image. Low CVE-2018-16644 at SUSE CVE-2018-16644 at NVD SUSE bug 1107609 SUSE bug 1107612 SUSE bug 1117463 SUSE Liberty Linux 7 LTSS There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file. Low CVE-2018-16645 at SUSE CVE-2018-16645 at NVD SUSE bug 1107604 SUSE Liberty Linux 7 In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. Low CVE-2018-16646 at SUSE CVE-2018-16646 at NVD SUSE bug 1107597 SUSE bug 1140882 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940. Low CVE-2018-16658 at SUSE CVE-2018-16658 at NVD SUSE bug 1092903 SUSE bug 1107689 SUSE bug 1113751 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file. Low CVE-2018-16749 at SUSE CVE-2018-16749 at NVD SUSE bug 1108282 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found. Low CVE-2018-16750 at SUSE CVE-2018-16750 at NVD SUSE bug 1108283 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509. Moderate CVE-2018-16802 at SUSE CVE-2018-16802 at NVD SUSE bug 1107410 SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117327 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. Moderate CVE-2018-16838 at SUSE CVE-2018-16838 at NVD SUSE bug 1124194 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Moderate CVE-2018-16842 at SUSE CVE-2018-16842 at NVD SUSE bug 1113660 SUSE bug 1122464 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7. Important CVE-2018-16863 at SUSE CVE-2018-16863 at NVD SUSE bug 1118318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable. Important CVE-2018-16864 at SUSE CVE-2018-16864 at NVD SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable. Important CVE-2018-16865 at SUSE CVE-2018-16865 at NVD SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1188063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable. Low CVE-2018-16866 at SUSE CVE-2018-16866 at NVD SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 SUSE bug 1126183 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost. Moderate CVE-2018-16871 at SUSE CVE-2018-16871 at NVD SUSE bug 1137103 SUSE bug 1156320 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable. Important CVE-2018-16881 at SUSE CVE-2018-16881 at NVD SUSE bug 1123164 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Important CVE-2018-16884 at SUSE CVE-2018-16884 at NVD SUSE bug 1119946 SUSE bug 1119947 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7. Moderate CVE-2018-16885 at SUSE CVE-2018-16885 at NVD SUSE bug 1120258 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable. Moderate CVE-2018-16888 at SUSE CVE-2018-16888 at NVD SUSE bug 1065951 SUSE bug 1120625 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0. A heap-based buffer overflow in Expand3To4Module::run has occurred when running sfconvert. Important CVE-2018-17095 at SUSE CVE-2018-17095 at NVD SUSE bug 1111586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. Low CVE-2018-17100 at SUSE CVE-2018-17100 at NVD SUSE bug 1108637 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. Low CVE-2018-17101 at SUSE CVE-2018-17101 at NVD SUSE bug 1108627 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code. Moderate CVE-2018-17183 at SUSE CVE-2018-17183 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117331 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded. Moderate CVE-2018-17199 at SUSE CVE-2018-17199 at NVD SUSE bug 1122838 SUSE bug 1122839 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference. Low CVE-2018-17282 at SUSE CVE-2018-17282 at NVD SUSE bug 1109299 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings. Important CVE-2018-17336 at SUSE CVE-2018-17336 at NVD SUSE bug 1109406 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex. Important CVE-2018-17407 at SUSE CVE-2018-17407 at NVD SUSE bug 1109673 SUSE bug 1125938 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character. Important CVE-2018-17456 at SUSE CVE-2018-17456 at NVD SUSE bug 1110949 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Moderate CVE-2018-17466 at SUSE CVE-2018-17466 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. Low CVE-2018-17581 at SUSE CVE-2018-17581 at NVD SUSE bug 1110282 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file. Moderate CVE-2018-17828 at SUSE CVE-2018-17828 at NVD SUSE bug 1110687 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. Moderate CVE-2018-17961 at SUSE CVE-2018-17961 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117331 SUSE bug 1118455 SUSE bug 1129180 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. Low CVE-2018-17966 at SUSE CVE-2018-17966 at NVD SUSE bug 1110746 SUSE bug 1117463 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. Low CVE-2018-17967 at SUSE CVE-2018-17967 at NVD SUSE Liberty Linux 7 An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. Low CVE-2018-17972 at SUSE CVE-2018-17972 at NVD SUSE bug 1110785 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. Low CVE-2018-18016 at SUSE CVE-2018-18016 at NVD SUSE bug 1111072 SUSE bug 1117463 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. Low CVE-2018-18024 at SUSE CVE-2018-18024 at NVD SUSE bug 1111069 SUSE bug 1117463 SUSE Liberty Linux 7 snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. Important CVE-2018-18066 at SUSE CVE-2018-18066 at NVD SUSE bug 1111123 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. Moderate CVE-2018-18073 at SUSE CVE-2018-18073 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117331 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. Moderate CVE-2018-18074 at SUSE CVE-2018-18074 at NVD SUSE bug 1111622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19. Moderate CVE-2018-18281 at SUSE CVE-2018-18281 at NVD SUSE bug 1113769 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Moderate CVE-2018-18284 at SUSE CVE-2018-18284 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117331 SUSE bug 1118455 SUSE bug 1144621 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes. Low CVE-2018-18310 at SUSE CVE-2018-18310 at NVD SUSE bug 1111973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Important CVE-2018-18311 at SUSE CVE-2018-18311 at NVD SUSE bug 1114674 SUSE bug 1132018 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Moderate CVE-2018-18356 at SUSE CVE-2018-18356 at NVD SUSE bug 1118529 SUSE bug 1125330 SUSE bug 1125396 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12. Low CVE-2018-18384 at SUSE CVE-2018-18384 at NVD SUSE bug 1110194 SUSE bug 1148898 SUSE bug 1153715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c. Moderate CVE-2018-18397 at SUSE CVE-2018-18397 at NVD SUSE bug 1117656 SUSE bug 1171522 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. Low CVE-2018-18445 at SUSE CVE-2018-18445 at NVD SUSE bug 1112372 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Moderate CVE-2018-18492 at SUSE CVE-2018-18492 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Moderate CVE-2018-18493 at SUSE CVE-2018-18493 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Moderate CVE-2018-18494 at SUSE CVE-2018-18494 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Moderate CVE-2018-18498 at SUSE CVE-2018-18498 at NVD SUSE bug 1112111 SUSE bug 1119105 SUSE bug 1121207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Moderate CVE-2018-18500 at SUSE CVE-2018-18500 at NVD SUSE bug 1122983 SUSE bug 986639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Moderate CVE-2018-18501 at SUSE CVE-2018-18501 at NVD SUSE bug 1122983 SUSE bug 986639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Moderate CVE-2018-18505 at SUSE CVE-2018-18505 at NVD SUSE bug 1122983 SUSE bug 986639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65. Moderate CVE-2018-18506 at SUSE CVE-2018-18506 at NVD SUSE bug 1122983 SUSE bug 1129821 SUSE bug 986639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1. Moderate CVE-2018-18511 at SUSE CVE-2018-18511 at NVD SUSE bug 1125330 SUSE bug 1125396 SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. Low CVE-2018-18520 at SUSE CVE-2018-18520 at NVD SUSE bug 1112726 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Low CVE-2018-18521 at SUSE CVE-2018-18521 at NVD SUSE bug 1112723 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. Low CVE-2018-18544 at SUSE CVE-2018-18544 at NVD SUSE bug 1113064 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write. Moderate CVE-2018-18557 at SUSE CVE-2018-18557 at NVD SUSE bug 1113094 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control. Important CVE-2018-18559 at SUSE CVE-2018-18559 at NVD SUSE bug 1112859 SUSE bug 1112921 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write. Moderate CVE-2018-18584 at SUSE CVE-2018-18584 at NVD SUSE bug 1113038 SUSE bug 1113039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name). Moderate CVE-2018-18585 at SUSE CVE-2018-18585 at NVD SUSE bug 1113038 SUSE bug 1113039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in LibTIFF 4.0.9. There is a NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. Low CVE-2018-18661 at SUSE CVE-2018-18661 at NVD SUSE bug 1113672 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt. Moderate CVE-2018-18751 at SUSE CVE-2018-18751 at NVD SUSE bug 1113719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo. Low CVE-2018-18897 at SUSE CVE-2018-18897 at NVD SUSE bug 1114966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack. Low CVE-2018-18915 at SUSE CVE-2018-18915 at NVD SUSE bug 1114690 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd. Important CVE-2018-19044 at SUSE CVE-2018-19044 at NVD SUSE bug 1015141 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file. Low CVE-2018-19058 at SUSE CVE-2018-19058 at NVD SUSE bug 1115187 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts. Low CVE-2018-19059 at SUSE CVE-2018-19059 at NVD SUSE bug 1115186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path. Low CVE-2018-19060 at SUSE CVE-2018-19060 at NVD SUSE bug 1115185 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file. Low CVE-2018-19107 at SUSE CVE-2018-19107 at NVD SUSE bug 1115374 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file. Low CVE-2018-19108 at SUSE CVE-2018-19108 at NVD SUSE bug 1115364 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 keepalived before 2.0.7 has a heap-based buffer overflow when parsing HTTP status codes resulting in DoS or possibly unspecified other impact, because extract_status_code in lib/html.c has no validation of the status code and instead writes an unlimited amount of data to the heap. Important CVE-2018-19115 at SUSE CVE-2018-19115 at NVD SUSE bug 1015141 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type. Important CVE-2018-19134 at SUSE CVE-2018-19134 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment. Low CVE-2018-19149 at SUSE CVE-2018-19149 at NVD SUSE bug 1115626 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts. Critical CVE-2018-19198 at SUSE CVE-2018-19198 at NVD SUSE bug 1115722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication. Critical CVE-2018-19199 at SUSE CVE-2018-19199 at NVD SUSE bug 1115723 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h. Moderate CVE-2018-19208 at SUSE CVE-2018-19208 at NVD SUSE bug 1115713 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. Low CVE-2018-19409 at SUSE CVE-2018-19409 at NVD SUSE bug 1108027 SUSE bug 1109105 SUSE bug 1111479 SUSE bug 1111480 SUSE bug 1112229 SUSE bug 1117022 SUSE bug 1117331 SUSE bug 1118455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. Moderate CVE-2018-19475 at SUSE CVE-2018-19475 at NVD SUSE bug 1117327 SUSE bug 1117331 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion. Low CVE-2018-19476 at SUSE CVE-2018-19476 at NVD SUSE bug 1117313 SUSE bug 1117331 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion. Low CVE-2018-19477 at SUSE CVE-2018-19477 at NVD SUSE bug 1117274 SUSE bug 1117331 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization. Moderate CVE-2018-19519 at SUSE CVE-2018-19519 at NVD SUSE bug 1117267 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file. Moderate CVE-2018-19535 at SUSE CVE-2018-19535 at NVD SUSE bug 1117291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. Low CVE-2018-19607 at SUSE CVE-2018-19607 at NVD SUSE bug 1117513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows. Moderate CVE-2018-19622 at SUSE CVE-2018-19622 at NVD SUSE bug 1117740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service. Important CVE-2018-19662 at SUSE CVE-2018-19662 at NVD SUSE bug 1117925 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command. Moderate CVE-2018-19788 at SUSE CVE-2018-19788 at NVD SUSE bug 1118274 SUSE bug 1118277 SUSE bug 1119056 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp. Low CVE-2018-19869 at SUSE CVE-2018-19869 at NVD SUSE bug 1118599 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault. Low CVE-2018-19870 at SUSE CVE-2018-19870 at NVD SUSE bug 1118597 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. Low CVE-2018-19871 at SUSE CVE-2018-19871 at NVD SUSE bug 1118598 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. Moderate CVE-2018-19872 at SUSE CVE-2018-19872 at NVD SUSE bug 1130246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. Low CVE-2018-19873 at SUSE CVE-2018-19873 at NVD SUSE bug 1118596 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space. Moderate CVE-2018-19985 at SUSE CVE-2018-19985 at NVD SUSE bug 1120743 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Moderate CVE-2018-20060 at SUSE CVE-2018-20060 at NVD SUSE bug 1119376 SUSE bug 1216275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. Low CVE-2018-20096 at SUSE CVE-2018-20096 at NVD SUSE bug 1119513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. Moderate CVE-2018-20097 at SUSE CVE-2018-20097 at NVD SUSE bug 1119562 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. Moderate CVE-2018-20098 at SUSE CVE-2018-20098 at NVD SUSE bug 1119560 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. Moderate CVE-2018-20099 at SUSE CVE-2018-20099 at NVD SUSE bug 1119559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c. Moderate CVE-2018-20169 at SUSE CVE-2018-20169 at NVD SUSE bug 1119714 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Low CVE-2018-20467 at SUSE CVE-2018-20467 at NVD SUSE bug 1120381 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc. Low CVE-2018-20481 at SUSE CVE-2018-20481 at NVD SUSE bug 1120495 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service. Moderate CVE-2018-20532 at SUSE CVE-2018-20532 at NVD SUSE bug 1120629 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service. Moderate CVE-2018-20533 at SUSE CVE-2018-20533 at NVD SUSE bug 1120630 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application Low CVE-2018-20534 at SUSE CVE-2018-20534 at NVD SUSE bug 1120631 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach. Low CVE-2018-20650 at SUSE CVE-2018-20650 at NVD SUSE bug 1120939 SUSE bug 1120956 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. Low CVE-2018-20662 at SUSE CVE-2018-20662 at NVD SUSE bug 1120939 SUSE bug 1120956 SUSE bug 1214622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. Moderate CVE-2018-20676 at SUSE CVE-2018-20676 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. Moderate CVE-2018-20677 at SUSE CVE-2018-20677 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Moderate CVE-2018-20685 at SUSE CVE-2018-20685 at NVD SUSE bug 1121571 SUSE bug 1123220 SUSE bug 1131109 SUSE bug 1134932 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. Low CVE-2018-20836 at SUSE CVE-2018-20836 at NVD SUSE bug 1134395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks). Moderate CVE-2018-20843 at SUSE CVE-2018-20843 at NVD SUSE bug 1139937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. Moderate CVE-2018-20852 at SUSE CVE-2018-20852 at NVD SUSE bug 1141853 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled. Important CVE-2018-20856 at SUSE CVE-2018-20856 at NVD SUSE bug 1143048 SUSE bug 1156331 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter. Critical CVE-2018-20969 at SUSE CVE-2018-20969 at NVD SUSE bug 1146398 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. Low CVE-2018-21009 at SUSE CVE-2018-21009 at NVD SUSE bug 1149635 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). Critical CVE-2018-25011 at SUSE CVE-2018-25011 at NVD SUSE bug 1186247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). Critical CVE-2018-25014 at SUSE CVE-2018-25014 at NVD SUSE bug 1186250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Important CVE-2018-25032 at SUSE CVE-2018-25032 at NVD SUSE bug 1197459 SUSE bug 1197893 SUSE bug 1198667 SUSE bug 1199104 SUSE bug 1200049 SUSE bug 1201732 SUSE bug 1202688 SUSE bug 1224427 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Moderate CVE-2018-2562 at SUSE CVE-2018-2562 at NVD SUSE bug 1076369 SUSE bug 1078431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2018-2579 at SUSE CVE-2018-2579 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). Moderate CVE-2018-2582 at SUSE CVE-2018-2582 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2018-2588 at SUSE CVE-2018-2588 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Moderate CVE-2018-2599 at SUSE CVE-2018-2599 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded executes to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). Moderate CVE-2018-2602 at SUSE CVE-2018-2602 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2603 at SUSE CVE-2018-2603 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2018-2618 at SUSE CVE-2018-2618 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2622 at SUSE CVE-2018-2622 at NVD SUSE bug 1076369 SUSE bug 1078431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Moderate CVE-2018-2629 at SUSE CVE-2018-2629 at NVD SUSE bug 1076366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-2633 at SUSE CVE-2018-2633 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Moderate CVE-2018-2634 at SUSE CVE-2018-2634 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Moderate CVE-2018-2637 at SUSE CVE-2018-2637 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2640 at SUSE CVE-2018-2640 at NVD SUSE bug 1076369 SUSE bug 1078431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N). Moderate CVE-2018-2641 at SUSE CVE-2018-2641 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Moderate CVE-2018-2663 at SUSE CVE-2018-2663 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2665 at SUSE CVE-2018-2665 at NVD SUSE bug 1076369 SUSE bug 1078431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2668 at SUSE CVE-2018-2668 at NVD SUSE bug 1076369 SUSE bug 1078431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Moderate CVE-2018-2677 at SUSE CVE-2018-2677 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Moderate CVE-2018-2678 at SUSE CVE-2018-2678 at NVD SUSE bug 1076366 SUSE bug 1082810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-2755 at SUSE CVE-2018-2755 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2761 at SUSE CVE-2018-2761 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2018-2767 at SUSE CVE-2018-2767 at NVD SUSE bug 1088681 SUSE bug 1101675 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2771 at SUSE CVE-2018-2771 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2781 at SUSE CVE-2018-2781 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Moderate CVE-2018-2790 at SUSE CVE-2018-2790 at NVD SUSE bug 1090023 SUSE bug 1093311 SUSE bug 1101637 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-2794 at SUSE CVE-2018-2794 at NVD SUSE bug 1090024 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2795 at SUSE CVE-2018-2795 at NVD SUSE bug 1090025 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2796 at SUSE CVE-2018-2796 at NVD SUSE bug 1090026 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2797 at SUSE CVE-2018-2797 at NVD SUSE bug 1090027 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2798 at SUSE CVE-2018-2798 at NVD SUSE bug 1090028 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2799 at SUSE CVE-2018-2799 at NVD SUSE bug 1090029 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Moderate CVE-2018-2800 at SUSE CVE-2018-2800 at NVD SUSE bug 1090030 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2018-2813 at SUSE CVE-2018-2813 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-2814 at SUSE CVE-2018-2814 at NVD SUSE bug 1090032 SUSE bug 1093311 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-2815 at SUSE CVE-2018-2815 at NVD SUSE bug 1090033 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2817 at SUSE CVE-2018-2817 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-2819 at SUSE CVE-2018-2819 at NVD SUSE bug 1089987 SUSE bug 1090518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171; JRockit: R28.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2018-2952 at SUSE CVE-2018-2952 at NVD SUSE bug 1101645 SUSE bug 1101651 SUSE bug 1101656 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: MyISAM). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2018-3058 at SUSE CVE-2018-3058 at NVD SUSE bug 1101676 SUSE bug 1116686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.60 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-3063 at SUSE CVE-2018-3063 at NVD SUSE bug 1101677 SUSE bug 1116686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N). Low CVE-2018-3066 at SUSE CVE-2018-3066 at NVD SUSE bug 1101678 SUSE bug 1116686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Client component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. CVSS 3.0 Base Score 5.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H). Moderate CVE-2018-3081 at SUSE CVE-2018-3081 at NVD SUSE bug 1101680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N). Moderate CVE-2018-3136 at SUSE CVE-2018-3136 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Moderate CVE-2018-3139 at SUSE CVE-2018-3139 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-3149 at SUSE CVE-2018-3149 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Utility). The supported version that is affected is Java SE: 11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2018-3150 at SUSE CVE-2018-3150 at NVD SUSE bug 1112145 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 7u191, 8u182 and 11; Java SE Embedded: 8u181. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g. code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Moderate CVE-2018-3169 at SUSE CVE-2018-3169 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Moderate CVE-2018-3180 at SUSE CVE-2018-3180 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112147 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting). Supported versions that are affected are Java SE: 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Critical CVE-2018-3183 at SUSE CVE-2018-3183 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 SUSE bug 1120714 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2018-3214 at SUSE CVE-2018-3214 at NVD SUSE bug 1112142 SUSE bug 1112143 SUSE bug 1112144 SUSE bug 1112146 SUSE bug 1112148 SUSE bug 1112152 SUSE bug 1116574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2018-3282 at SUSE CVE-2018-3282 at NVD SUSE bug 1112432 SUSE bug 1116686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access. Moderate CVE-2018-3613 at SUSE CVE-2018-3613 at NVD SUSE bug 1115916 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis. Moderate CVE-2018-3620 at SUSE CVE-2018-3620 at NVD SUSE bug 1087078 SUSE bug 1087081 SUSE bug 1089343 SUSE bug 1090340 SUSE bug 1091107 SUSE bug 1099306 SUSE bug 1104894 SUSE bug 1136865 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Moderate CVE-2018-3639 at SUSE CVE-2018-3639 at NVD SUSE bug 1074701 SUSE bug 1085235 SUSE bug 1085308 SUSE bug 1087078 SUSE bug 1087082 SUSE bug 1092631 SUSE bug 1092885 SUSE bug 1094912 SUSE bug 1098813 SUSE bug 1100394 SUSE bug 1102640 SUSE bug 1105412 SUSE bug 1111963 SUSE bug 1172781 SUSE bug 1172782 SUSE bug 1172783 SUSE bug 1173489 SUSE bug 1178658 SUSE bug 1201877 SUSE bug 1215674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis. Important CVE-2018-3646 at SUSE CVE-2018-3646 at NVD SUSE bug 1087078 SUSE bug 1087081 SUSE bug 1089343 SUSE bug 1091107 SUSE bug 1099306 SUSE bug 1104365 SUSE bug 1104894 SUSE bug 1106548 SUSE bug 1113534 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. Moderate CVE-2018-3665 at SUSE CVE-2018-3665 at NVD SUSE bug 1087078 SUSE bug 1087082 SUSE bug 1087086 SUSE bug 1090338 SUSE bug 1095241 SUSE bug 1095242 SUSE bug 1096740 SUSE bug 1100091 SUSE bug 1100555 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis. Important CVE-2018-3693 at SUSE CVE-2018-3693 at NVD SUSE bug 1087078 SUSE bug 1087084 SUSE bug 1101008 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Moderate CVE-2018-4121 at SUSE CVE-2018-4121 at NVD SUSE bug 1092278 SUSE Liberty Linux 7 In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. Important CVE-2018-4180 at SUSE CVE-2018-4180 at NVD SUSE bug 1096405 SUSE bug 1096408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. Moderate CVE-2018-4181 at SUSE CVE-2018-4181 at NVD SUSE bug 1096406 SUSE bug 1096408 SUSE bug 1105281 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free. Moderate CVE-2018-4200 at SUSE CVE-2018-4200 at NVD SUSE bug 1092280 SUSE Liberty Linux 7 LTSS An issue was discovered in certain Apple products. iOS before 11.4 is affected. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Moderate CVE-2018-4204 at SUSE CVE-2018-4204 at NVD SUSE bug 1092279 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Important CVE-2018-4700 at SUSE CVE-2018-4700 at NVD SUSE bug 1115750 SUSE bug 1131480 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5089 at SUSE CVE-2018-5089 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Firefox < 58. Moderate CVE-2018-5091 at SUSE CVE-2018-5091 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5095 at SUSE CVE-2018-5095 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6. Moderate CVE-2018-5096 at SUSE CVE-2018-5096 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5097 at SUSE CVE-2018-5097 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5098 at SUSE CVE-2018-5098 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5099 at SUSE CVE-2018-5099 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5102 at SUSE CVE-2018-5102 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5103 at SUSE CVE-2018-5103 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5104 at SUSE CVE-2018-5104 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Moderate CVE-2018-5117 at SUSE CVE-2018-5117 at NVD SUSE bug 1077291 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59. Important CVE-2018-5125 at SUSE CVE-2018-5125 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59. Important CVE-2018-5127 at SUSE CVE-2018-5127 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59. Important CVE-2018-5129 at SUSE CVE-2018-5129 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59. Moderate CVE-2018-5130 at SUSE CVE-2018-5130 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59. Moderate CVE-2018-5131 at SUSE CVE-2018-5131 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7. Moderate CVE-2018-5144 at SUSE CVE-2018-5144 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7. Moderate CVE-2018-5145 at SUSE CVE-2018-5145 at NVD SUSE bug 1085130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7. Moderate CVE-2018-5146 at SUSE CVE-2018-5146 at NVD SUSE bug 1085671 SUSE bug 1085687 SUSE bug 1180395 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.7.3 and Firefox < 59.0.2. Moderate CVE-2018-5148 at SUSE CVE-2018-5148 at NVD SUSE bug 1087059 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Important CVE-2018-5150 at SUSE CVE-2018-5150 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Important CVE-2018-5154 at SUSE CVE-2018-5154 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Important CVE-2018-5155 at SUSE CVE-2018-5155 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-5156 at SUSE CVE-2018-5156 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60. Important CVE-2018-5157 at SUSE CVE-2018-5157 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60. Important CVE-2018-5158 at SUSE CVE-2018-5158 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Important CVE-2018-5159 at SUSE CVE-2018-5159 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. Important CVE-2018-5161 at SUSE CVE-2018-5161 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. Important CVE-2018-5162 at SUSE CVE-2018-5162 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093151 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Important CVE-2018-5168 at SUSE CVE-2018-5168 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. Important CVE-2018-5170 at SUSE CVE-2018-5170 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8. Important CVE-2018-5178 at SUSE CVE-2018-5178 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8. Important CVE-2018-5183 at SUSE CVE-2018-5183 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. Important CVE-2018-5184 at SUSE CVE-2018-5184 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093152 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. Important CVE-2018-5185 at SUSE CVE-2018-5185 at NVD SUSE bug 1092548 SUSE bug 1092611 SUSE bug 1093151 SUSE bug 1093969 SUSE bug 1093970 SUSE bug 1093971 SUSE bug 1093972 SUSE bug 1093973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61. Important CVE-2018-5188 at SUSE CVE-2018-5188 at NVD SUSE bug 1098998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact. Low CVE-2018-5344 at SUSE CVE-2018-5344 at NVD SUSE bug 1075825 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file. Low CVE-2018-5345 at SUSE CVE-2018-5345 at NVD SUSE bug 1075745 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. Critical CVE-2018-5379 at SUSE CVE-2018-5379 at NVD SUSE bug 1079799 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device. Moderate CVE-2018-5383 at SUSE CVE-2018-5383 at NVD SUSE bug 1104301 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. Moderate CVE-2018-5390 at SUSE CVE-2018-5390 at NVD SUSE bug 1087082 SUSE bug 1102340 SUSE bug 1102682 SUSE bug 1103097 SUSE bug 1103098 SUSE bug 1156434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size. Moderate CVE-2018-5391 at SUSE CVE-2018-5391 at NVD SUSE bug 1087082 SUSE bug 1102340 SUSE bug 1103097 SUSE bug 1103098 SUSE bug 1108654 SUSE bug 1114071 SUSE bug 1121102 SUSE bug 1134140 SUSE bug 1181460 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. Moderate CVE-2018-5407 at SUSE CVE-2018-5407 at NVD SUSE bug 1113534 SUSE bug 1116195 SUSE bug 1126909 SUSE bug 1148697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation. Moderate CVE-2018-5683 at SUSE CVE-2018-5683 at NVD SUSE bug 1076114 SUSE bug 1076116 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. Moderate CVE-2018-5712 at SUSE CVE-2018-5712 at NVD SUSE bug 1076220 SUSE bug 1076391 SUSE bug 1091362 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. Moderate CVE-2018-5729 at SUSE CVE-2018-5729 at NVD SUSE bug 1076211 SUSE bug 1083926 SUSE bug 1122468 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Moderate CVE-2018-5730 at SUSE CVE-2018-5730 at NVD SUSE bug 1076211 SUSE bug 1083927 SUSE bug 1122468 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0 Important CVE-2018-5732 at SUSE CVE-2018-5732 at NVD SUSE bug 1083302 SUSE bug 1085417 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0. Moderate CVE-2018-5733 at SUSE CVE-2018-5733 at NVD SUSE bug 1083303 SUSE bug 1085417 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2. Important CVE-2018-5740 at SUSE CVE-2018-5740 at NVD SUSE bug 1104129 SUSE bug 1141730 SUSE bug 1148887 SUSE bug 1177790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update request. Unfortunately, some rule types were not initially documented, and when documentation for them was added to the Administrator Reference Manual (ARM) in change #3112, the language that was added to the ARM at that time incorrectly described the behavior of two rule types, krb5-subdomain and ms-subdomain. This incorrect documentation could mislead operators into believing that policies they had configured were more restrictive than they actually were. This affects BIND versions prior to BIND 9.11.5 and BIND 9.12.3. Moderate CVE-2018-5741 at SUSE CVE-2018-5741 at NVD SUSE bug 1109160 SUSE bug 1171740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected. Moderate CVE-2018-5742 at SUSE CVE-2018-5742 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743. Important CVE-2018-5743 at SUSE CVE-2018-5743 at NVD SUSE bug 1133185 SUSE bug 1148887 SUSE bug 1157051 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745. Moderate CVE-2018-5745 at SUSE CVE-2018-5745 at NVD SUSE bug 1126068 SUSE bug 1141730 SUSE bug 1148887 SUSE bug 1177790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. Low CVE-2018-5748 at SUSE CVE-2018-5748 at NVD SUSE bug 1076500 SUSE bug 1083625 SUSE bug 1087887 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call. Moderate CVE-2018-5750 at SUSE CVE-2018-5750 at NVD SUSE bug 1077892 SUSE bug 1087082 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash. Low CVE-2018-5800 at SUSE CVE-2018-5800 at NVD SUSE bug 1084691 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference. Low CVE-2018-5801 at SUSE CVE-2018-5801 at NVD SUSE bug 1084690 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An error within the "kodak_radc_load_raw()" function (internal/dcraw_common.cpp) related to the "buf" variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash. Low CVE-2018-5802 at SUSE CVE-2018-5802 at NVD SUSE bug 1084688 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash. Low CVE-2018-5803 at SUSE CVE-2018-5803 at NVD SUSE bug 1083900 SUSE bug 1087082 SUSE bug 1115893 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash. Moderate CVE-2018-5805 at SUSE CVE-2018-5805 at NVD SUSE bug 1097973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference. Moderate CVE-2018-5806 at SUSE CVE-2018-5806 at NVD SUSE bug 1097974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. Moderate CVE-2018-5848 at SUSE CVE-2018-5848 at NVD SUSE bug 1087082 SUSE bug 1097356 SUSE bug 1105412 SUSE bug 1115339 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL. Moderate CVE-2018-5950 at SUSE CVE-2018-5950 at NVD SUSE bug 1077358 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Important CVE-2018-6126 at SUSE CVE-2018-6126 at NVD SUSE bug 1095163 SUSE bug 1096449 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption. Moderate CVE-2018-6485 at SUSE CVE-2018-6485 at NVD SUSE bug 1079036 SUSE bug 1123874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. Moderate CVE-2018-6541 at SUSE CVE-2018-6541 at NVD SUSE bug 1079095 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon. Important CVE-2018-6560 at SUSE CVE-2018-6560 at NVD SUSE bug 1078923 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked. Important CVE-2018-6574 at SUSE CVE-2018-6574 at NVD SUSE bug 1080006 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module. Low CVE-2018-6764 at SUSE CVE-2018-6764 at NVD SUSE bug 1080042 SUSE bug 1088147 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element. Moderate CVE-2018-6790 at SUSE CVE-2018-6790 at NVD SUSE bug 1079429 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. Low CVE-2018-6914 at SUSE CVE-2018-6914 at NVD SUSE bug 1087441 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value. Moderate CVE-2018-6927 at SUSE CVE-2018-6927 at NVD SUSE bug 1080757 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. Low CVE-2018-6952 at SUSE CVE-2018-6952 at NVD SUSE bug 1080985 SUSE bug 1167721 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete. Low CVE-2018-7159 at SUSE CVE-2018-7159 at NVD SUSE bug 1087453 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343. Moderate CVE-2018-7191 at SUSE CVE-2018-7191 at NVD SUSE bug 1135603 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object. Low CVE-2018-7208 at SUSE CVE-2018-7208 at NVD SUSE bug 1081527 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets. Important CVE-2018-7225 at SUSE CVE-2018-7225 at NVD SUSE bug 1081493 SUSE bug 1090647 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c. Critical CVE-2018-7409 at SUSE CVE-2018-7409 at NVD SUSE bug 1082290 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value. Moderate CVE-2018-7418 at SUSE CVE-2018-7418 at NVD SUSE bug 1082692 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.) Moderate CVE-2018-7456 at SUSE CVE-2018-7456 at NVD SUSE bug 1074317 SUSE bug 1082825 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact. Critical CVE-2018-7485 at SUSE CVE-2018-7485 at NVD SUSE bug 1082484 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. Low CVE-2018-7549 at SUSE CVE-2018-7549 at NVD SUSE bug 1082991 SUSE bug 1200039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. Important CVE-2018-7550 at SUSE CVE-2018-7550 at NVD SUSE bug 1083291 SUSE bug 1083292 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. Moderate CVE-2018-7566 at SUSE CVE-2018-7566 at NVD SUSE bug 1083483 SUSE bug 1083488 SUSE bug 1087082 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm. Moderate CVE-2018-7568 at SUSE CVE-2018-7568 at NVD SUSE bug 1086788 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. Moderate CVE-2018-7569 at SUSE CVE-2018-7569 at NVD SUSE bug 1083532 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. Moderate CVE-2018-7584 at SUSE CVE-2018-7584 at NVD SUSE bug 1083639 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy. Moderate CVE-2018-7642 at SUSE CVE-2018-7642 at NVD SUSE bug 1086786 SUSE bug 1128518 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump. Moderate CVE-2018-7643 at SUSE CVE-2018-7643 at NVD SUSE bug 1086784 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service. Low CVE-2018-7725 at SUSE CVE-2018-7725 at NVD SUSE bug 1084519 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. Low CVE-2018-7726 at SUSE CVE-2018-7726 at NVD SUSE bug 1084517 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of service attack. Low CVE-2018-7727 at SUSE CVE-2018-7727 at NVD SUSE bug 1084515 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based buffer over-read in the PSD_MetaHandler::CacheFileData() function. Low CVE-2018-7730 at SUSE CVE-2018-7730 at NVD SUSE bug 1085295 SUSE bug 1085585 SUSE bug 1103718 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call. Moderate CVE-2018-7740 at SUSE CVE-2018-7740 at NVD SUSE bug 1084353 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR. Low CVE-2018-7755 at SUSE CVE-2018-7755 at NVD SUSE bug 1084513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. Moderate CVE-2018-7757 at SUSE CVE-2018-7757 at NVD SUSE bug 1084536 SUSE bug 1087082 SUSE bug 1087209 SUSE bug 1091815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display. Moderate CVE-2018-7858 at SUSE CVE-2018-7858 at NVD SUSE bug 1084604 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. Low CVE-2018-8014 at SUSE CVE-2018-8014 at NVD SUSE bug 1093697 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88. Moderate CVE-2018-8034 at SUSE CVE-2018-8034 at NVD SUSE bug 1102379 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering an out-of-array error case. Moderate CVE-2018-8087 at SUSE CVE-2018-8087 at NVD SUSE bug 1085053 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series. Important CVE-2018-8088 at SUSE CVE-2018-8088 at NVD SUSE bug 1085970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). Important CVE-2018-8777 at SUSE CVE-2018-8777 at NVD SUSE bug 1087436 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. Moderate CVE-2018-8778 at SUSE CVE-2018-8778 at NVD SUSE bug 1087433 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. Low CVE-2018-8779 at SUSE CVE-2018-8779 at NVD SUSE bug 1087440 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. Low CVE-2018-8780 at SUSE CVE-2018-8780 at NVD SUSE bug 1087437 SUSE bug 1136906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space. Moderate CVE-2018-8781 at SUSE CVE-2018-8781 at NVD SUSE bug 1087082 SUSE bug 1090643 SUSE bug 1090646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution. Important CVE-2018-8786 at SUSE CVE-2018-8786 at NVD SUSE bug 1116708 SUSE bug 1117963 SUSE bug 1117966 SUSE bug 1131873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution. Important CVE-2018-8787 at SUSE CVE-2018-8787 at NVD SUSE bug 1116708 SUSE bug 1117963 SUSE bug 1117964 SUSE bug 1131873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution. Important CVE-2018-8788 at SUSE CVE-2018-8788 at NVD SUSE bug 1116708 SUSE bug 1117963 SUSE bug 1131873 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file. Low CVE-2018-8804 at SUSE CVE-2018-8804 at NVD SUSE bug 1086011 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. Important CVE-2018-8897 at SUSE CVE-2018-8897 at NVD SUSE bug 1087078 SUSE bug 1087088 SUSE bug 1090368 SUSE bug 1090820 SUSE bug 1090869 SUSE bug 1092497 SUSE bug 1093522 SUSE bug 1093524 SUSE bug 1098813 SUSE bug 1100835 SUSE bug 1115893 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps. Moderate CVE-2018-8905 at SUSE CVE-2018-8905 at NVD SUSE bug 1086408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section. Low CVE-2018-8945 at SUSE CVE-2018-8945 at NVD SUSE bug 1086608 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file. Low CVE-2018-8976 at SUSE CVE-2018-8976 at NVD SUSE bug 1086810 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a denial of service (invalid memory access) via a crafted file. Low CVE-2018-8977 at SUSE CVE-2018-8977 at NVD SUSE bug 1086798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file. Moderate CVE-2018-9133 at SUSE CVE-2018-9133 at NVD SUSE bug 1087820 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case. Low CVE-2018-9305 at SUSE CVE-2018-9305 at NVD SUSE bug 1088424 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel. Important CVE-2018-9363 at SUSE CVE-2018-9363 at NVD SUSE bug 1087082 SUSE bug 1105292 SUSE bug 1105293 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-71361580. Low CVE-2018-9516 at SUSE CVE-2018-9516 at NVD SUSE bug 1108498 SUSE bug 1123161 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. Low CVE-2018-9517 at SUSE CVE-2018-9517 at NVD SUSE bug 1108488 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel. Moderate CVE-2018-9568 at SUSE CVE-2018-9568 at NVD SUSE bug 1118319 SUSE bug 1118320 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access. Important CVE-2019-0154 at SUSE CVE-2019-0154 at NVD SUSE bug 1135966 SUSE bug 1181720 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2019-0155 at SUSE CVE-2019-0155 at NVD SUSE bug 1135966 SUSE bug 1135967 SUSE bug 1173663 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access. Moderate CVE-2019-0160 at SUSE CVE-2019-0160 at NVD SUSE bug 1130267 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. Moderate CVE-2019-0161 at SUSE CVE-2019-0161 at NVD SUSE bug 1131361 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. Moderate CVE-2019-0217 at SUSE CVE-2019-0217 at NVD SUSE bug 1131239 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. Moderate CVE-2019-0220 at SUSE CVE-2019-0220 at NVD SUSE bug 1131241 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'. Moderate CVE-2019-0816 at SUSE CVE-2019-0816 at NVD SUSE bug 1129124 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file. Low CVE-2019-1000019 at SUSE CVE-2019-1000019 at NVD SUSE bug 1124341 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. Low CVE-2019-1000020 at SUSE CVE-2019-1000020 at NVD SUSE bug 1124342 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI. Important CVE-2019-10063 at SUSE CVE-2019-10063 at NVD SUSE bug 1130637 SUSE bug 1133041 SUSE bug 1133043 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. Important CVE-2019-10086 at SUSE CVE-2019-10086 at NVD SUSE bug 1146657 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. Low CVE-2019-10098 at SUSE CVE-2019-10098 at NVD SUSE bug 1145738 SUSE bug 1168407 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize. Important CVE-2019-1010238 at SUSE CVE-2019-1010238 at NVD SUSE bug 1142332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. Low CVE-2019-1010305 at SUSE CVE-2019-1010305 at NVD SUSE bug 1141680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences. Important CVE-2019-10126 at SUSE CVE-2019-10126 at NVD SUSE bug 1136935 SUSE bug 1137944 SUSE bug 1142129 SUSE bug 1156330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. Moderate CVE-2019-10131 at SUSE CVE-2019-10131 at NVD SUSE bug 1134075 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. Important CVE-2019-10132 at SUSE CVE-2019-10132 at NVD SUSE bug 1134348 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue." Moderate CVE-2019-10143 at SUSE CVE-2019-10143 at NVD SUSE bug 1136195 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser. Moderate CVE-2019-10146 at SUSE CVE-2019-10146 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member. Moderate CVE-2019-10153 at SUSE CVE-2019-10153 at NVD SUSE bug 1137314 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application. Important CVE-2019-10160 at SUSE CVE-2019-10160 at NVD SUSE bug 1138459 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. Important CVE-2019-10161 at SUSE CVE-2019-10161 at NVD SUSE bug 1138301 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. Important CVE-2019-10166 at SUSE CVE-2019-10166 at NVD SUSE bug 1138302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Important CVE-2019-10167 at SUSE CVE-2019-10167 at NVD SUSE bug 1138303 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Important CVE-2019-10168 at SUSE CVE-2019-10168 at NVD SUSE bug 1138305 SUSE bug 1138582 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code. Moderate CVE-2019-10179 at SUSE CVE-2019-10179 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox. Important CVE-2019-10181 at SUSE CVE-2019-10181 at NVD SUSE bug 1142835 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user. Moderate CVE-2019-10182 at SUSE CVE-2019-10182 at NVD SUSE bug 1142825 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox. Important CVE-2019-10185 at SUSE CVE-2019-10185 at NVD SUSE bug 1142832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed. Moderate CVE-2019-10195 at SUSE CVE-2019-10195 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share. Important CVE-2019-10197 at SUSE CVE-2019-10197 at NVD SUSE bug 1141267 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash. Low CVE-2019-10207 at SUSE CVE-2019-10207 at NVD SUSE bug 1123959 SUSE bug 1142857 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function. Moderate CVE-2019-10208 at SUSE CVE-2019-10208 at NVD SUSE bug 1145092 SUSE bug 1171566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas. Moderate CVE-2019-10216 at SUSE CVE-2019-10216 at NVD SUSE bug 1144621 SUSE bug 1146882 SUSE bug 1146884 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. Moderate CVE-2019-10218 at SUSE CVE-2019-10218 at NVD SUSE bug 1144902 SUSE bug 1144903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser. Moderate CVE-2019-10221 at SUSE CVE-2019-10221 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. Moderate CVE-2019-10638 at SUSE CVE-2019-10638 at NVD SUSE bug 1140575 SUSE bug 1140577 SUSE bug 1142129 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace. Moderate CVE-2019-10639 at SUSE CVE-2019-10639 at NVD SUSE bug 1140577 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file. Moderate CVE-2019-10650 at SUSE CVE-2019-10650 at NVD SUSE bug 1131317 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. Moderate CVE-2019-10871 at SUSE CVE-2019-10871 at NVD SUSE bug 1131696 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. Moderate CVE-2019-11043 at SUSE CVE-2019-11043 at NVD SUSE bug 1154999 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. Moderate CVE-2019-11068 at SUSE CVE-2019-11068 at NVD SUSE bug 1132160 SUSE bug 1154212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded. Moderate CVE-2019-11070 at SUSE CVE-2019-11070 at NVD SUSE bug 1132196 SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Moderate CVE-2019-11085 at SUSE CVE-2019-11085 at NVD SUSE bug 1135278 SUSE bug 1135280 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf Moderate CVE-2019-11091 at SUSE CVE-2019-11091 at NVD SUSE bug 1103186 SUSE bug 1111331 SUSE bug 1132686 SUSE bug 1133319 SUSE bug 1135394 SUSE bug 1138043 SUSE bug 1138534 SUSE bug 1141977 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. Moderate CVE-2019-11135 at SUSE CVE-2019-11135 at NVD SUSE bug 1139073 SUSE bug 1152497 SUSE bug 1152505 SUSE bug 1152506 SUSE bug 1160120 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. CVE-2019-11190 at SUSE CVE-2019-11190 at NVD SUSE bug 1131543 SUSE bug 1132374 SUSE bug 1132472 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. Moderate CVE-2019-11234 at SUSE CVE-2019-11234 at NVD SUSE bug 1132664 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. Important CVE-2019-11235 at SUSE CVE-2019-11235 at NVD SUSE bug 1132549 SUSE bug 1132664 SUSE bug 1144524 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. Low CVE-2019-11236 at SUSE CVE-2019-11236 at NVD SUSE bug 1129071 SUSE bug 1132663 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2019-1125 at SUSE CVE-2019-1125 at NVD SUSE bug 1139358 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. Low CVE-2019-11324 at SUSE CVE-2019-11324 at NVD SUSE bug 1132900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. Moderate CVE-2019-11358 at SUSE CVE-2019-11358 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. Moderate CVE-2019-11459 at SUSE CVE-2019-11459 at NVD SUSE bug 1133037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file. Moderate CVE-2019-11470 at SUSE CVE-2019-11470 at NVD SUSE bug 1133205 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first. Moderate CVE-2019-11472 at SUSE CVE-2019-11472 at NVD SUSE bug 1133202 SUSE bug 1133203 SUSE bug 1133204 SUSE bug 1146213 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. Important CVE-2019-11477 at SUSE CVE-2019-11477 at NVD SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1153242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e. Important CVE-2019-11478 at SUSE CVE-2019-11478 at NVD SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1143542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. Important CVE-2019-11479 at SUSE CVE-2019-11479 at NVD SUSE bug 1132686 SUSE bug 1137586 SUSE bug 1142129 SUSE bug 1143542 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests. Moderate CVE-2019-11487 at SUSE CVE-2019-11487 at NVD SUSE bug 1133190 SUSE bug 1133191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution. Important CVE-2019-11500 at SUSE CVE-2019-11500 at NVD SUSE bug 1145559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. Moderate CVE-2019-11597 at SUSE CVE-2019-11597 at NVD SUSE bug 1138464 SUSE bug 1146211 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. Moderate CVE-2019-11598 at SUSE CVE-2019-11598 at NVD SUSE bug 1136732 SUSE bug 1179313 SUSE bug 1179336 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. Low CVE-2019-11599 at SUSE CVE-2019-11599 at NVD SUSE bug 1131645 SUSE bug 1133738 SUSE bug 1157905 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-11691 at SUSE CVE-2019-11691 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-11692 at SUSE CVE-2019-11692 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-11693 at SUSE CVE-2019-11693 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-11698 at SUSE CVE-2019-11698 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. Moderate CVE-2019-11703 at SUSE CVE-2019-11703 at NVD SUSE bug 1137595 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. Moderate CVE-2019-11704 at SUSE CVE-2019-11704 at NVD SUSE bug 1137595 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1. Moderate CVE-2019-11705 at SUSE CVE-2019-11705 at NVD SUSE bug 1137595 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1. Moderate CVE-2019-11706 at SUSE CVE-2019-11706 at NVD SUSE bug 1137595 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. Moderate CVE-2019-11707 at SUSE CVE-2019-11707 at NVD SUSE bug 1138614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. Critical CVE-2019-11708 at SUSE CVE-2019-11708 at NVD SUSE bug 1138872 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11709 at SUSE CVE-2019-11709 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11711 at SUSE CVE-2019-11711 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11712 at SUSE CVE-2019-11712 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11713 at SUSE CVE-2019-11713 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11715 at SUSE CVE-2019-11715 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11717 at SUSE CVE-2019-11717 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11719 at SUSE CVE-2019-11719 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68. Low CVE-2019-11727 at SUSE CVE-2019-11727 at NVD SUSE bug 1140868 SUSE bug 1141322 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11729 at SUSE CVE-2019-11729 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-11730 at SUSE CVE-2019-11730 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2. Moderate CVE-2019-11733 at SUSE CVE-2019-11733 at NVD SUSE bug 1145665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. Moderate CVE-2019-11739 at SUSE CVE-2019-11739 at NVD SUSE bug 1150939 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Important CVE-2019-11740 at SUSE CVE-2019-11740 at NVD SUSE bug 1149299 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a &lt;canvas&gt; element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Important CVE-2019-11742 at SUSE CVE-2019-11742 at NVD SUSE bug 1149303 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Moderate CVE-2019-11743 at SUSE CVE-2019-11743 at NVD SUSE bug 1149298 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Important CVE-2019-11744 at SUSE CVE-2019-11744 at NVD SUSE bug 1149304 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-11745 at SUSE CVE-2019-11745 at NVD SUSE bug 1158328 SUSE bug 1158527 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Important CVE-2019-11746 at SUSE CVE-2019-11746 at NVD SUSE bug 1149297 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. Important CVE-2019-11752 at SUSE CVE-2019-11752 at NVD SUSE bug 1149296 SUSE bug 1149323 SUSE bug 1149324 SUSE bug 1150940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71. Important CVE-2019-11756 at SUSE CVE-2019-11756 at NVD SUSE bug 1161447 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11757 at SUSE CVE-2019-11757 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11758 at SUSE CVE-2019-11758 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11759 at SUSE CVE-2019-11759 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11760 at SUSE CVE-2019-11760 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11761 at SUSE CVE-2019-11761 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11762 at SUSE CVE-2019-11762 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11763 at SUSE CVE-2019-11763 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Important CVE-2019-11764 at SUSE CVE-2019-11764 at NVD SUSE bug 1154738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free. Low CVE-2019-11810 at SUSE CVE-2019-11810 at NVD SUSE bug 1134399 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. Low CVE-2019-11811 at SUSE CVE-2019-11811 at NVD SUSE bug 1134397 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. Low CVE-2019-11833 at SUSE CVE-2019-11833 at NVD SUSE bug 1135281 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. Moderate CVE-2019-11884 at SUSE CVE-2019-11884 at NVD SUSE bug 1134848 SUSE bug 1139868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference. Low CVE-2019-12155 at SUSE CVE-2019-12155 at NVD SUSE bug 1135902 SUSE bug 1135905 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. Moderate CVE-2019-12293 at SUSE CVE-2019-12293 at NVD SUSE bug 1136105 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference Low CVE-2019-12382 at SUSE CVE-2019-12382 at NVD SUSE bug 1136586 SUSE bug 1155298 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. Moderate CVE-2019-12387 at SUSE CVE-2019-12387 at NVD SUSE bug 1137825 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. Important CVE-2019-12420 at SUSE CVE-2019-12420 at NVD SUSE bug 1159133 SUSE bug 1186513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. Important CVE-2019-12450 at SUSE CVE-2019-12450 at NVD SUSE bug 1137001 SUSE bug 1139959 SUSE bug 1142126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow. Important CVE-2019-12519 at SUSE CVE-2019-12519 at NVD SUSE bug 1169659 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. Important CVE-2019-12525 at SUSE CVE-2019-12525 at NVD SUSE bug 1141332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. Moderate CVE-2019-12528 at SUSE CVE-2019-12528 at NVD SUSE bug 1162689 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). Moderate CVE-2019-12614 at SUSE CVE-2019-12614 at NVD SUSE bug 1137194 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Moderate CVE-2019-12735 at SUSE CVE-2019-12735 at NVD SUSE bug 1137443 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. Moderate CVE-2019-12749 at SUSE CVE-2019-12749 at NVD SUSE bug 1137832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL. Moderate CVE-2019-12779 at SUSE CVE-2019-12779 at NVD SUSE bug 1137835 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted image. Moderate CVE-2019-12974 at SUSE CVE-2019-12974 at NVD SUSE bug 1140111 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c. Low CVE-2019-12975 at SUSE CVE-2019-12975 at NVD SUSE bug 1140106 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. Moderate CVE-2019-12976 at SUSE CVE-2019-12976 at NVD SUSE bug 1140110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c. Moderate CVE-2019-12978 at SUSE CVE-2019-12978 at NVD SUSE bug 1139885 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c. Moderate CVE-2019-12979 at SUSE CVE-2019-12979 at NVD SUSE bug 1139886 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. Moderate CVE-2019-13038 at SUSE CVE-2019-13038 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c. Moderate CVE-2019-13133 at SUSE CVE-2019-13133 at NVD SUSE bug 1140100 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. Moderate CVE-2019-13134 at SUSE CVE-2019-13134 at NVD SUSE bug 1140102 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. Moderate CVE-2019-13135 at SUSE CVE-2019-13135 at NVD SUSE bug 1140103 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue. Low CVE-2019-13232 at SUSE CVE-2019-13232 at NVD SUSE bug 1140748 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation. Low CVE-2019-13233 at SUSE CVE-2019-13233 at NVD SUSE bug 1140454 SUSE bug 1144502 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. Moderate CVE-2019-13295 at SUSE CVE-2019-13295 at NVD SUSE bug 1140664 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. Moderate CVE-2019-13297 at SUSE CVE-2019-13297 at NVD SUSE bug 1140666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. Moderate CVE-2019-13300 at SUSE CVE-2019-13300 at NVD SUSE bug 1140669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. Moderate CVE-2019-13301 at SUSE CVE-2019-13301 at NVD SUSE bug 1140554 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment. Important CVE-2019-13304 at SUSE CVE-2019-13304 at NVD SUSE bug 1140547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. Important CVE-2019-13305 at SUSE CVE-2019-13305 at NVD SUSE bug 1140545 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. Moderate CVE-2019-13306 at SUSE CVE-2019-13306 at NVD SUSE bug 1140543 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows. Moderate CVE-2019-13307 at SUSE CVE-2019-13307 at NVD SUSE bug 1140538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c. Low CVE-2019-13309 at SUSE CVE-2019-13309 at NVD SUSE bug 1140501 SUSE bug 1140520 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. Low CVE-2019-13310 at SUSE CVE-2019-13310 at NVD SUSE bug 1140501 SUSE bug 1140520 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. Low CVE-2019-13311 at SUSE CVE-2019-13311 at NVD SUSE bug 1140513 SUSE bug 1140554 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. Low CVE-2019-13313 at SUSE CVE-2019-13313 at NVD SUSE bug 1140749 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. Moderate CVE-2019-13345 at SUSE CVE-2019-13345 at NVD SUSE bug 1140738 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. Moderate CVE-2019-13454 at SUSE CVE-2019-13454 at NVD SUSE bug 1141171 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494. Moderate CVE-2019-13456 at SUSE CVE-2019-13456 at NVD SUSE bug 1144524 SUSE bug 1166858 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. Moderate CVE-2019-13616 at SUSE CVE-2019-13616 at NVD SUSE bug 1141844 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156. Important CVE-2019-13638 at SUSE CVE-2019-13638 at NVD SUSE bug 1088420 SUSE bug 1142513 SUSE bug 1146398 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c. Low CVE-2019-13648 at SUSE CVE-2019-13648 at NVD SUSE bug 1142254 SUSE bug 1142265 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2019-13734 at SUSE CVE-2019-13734 at NVD SUSE bug 1158982 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones. Important CVE-2019-1387 at SUSE CVE-2019-1387 at NVD SUSE bug 1158785 SUSE bug 1158793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default. Moderate CVE-2019-14283 at SUSE CVE-2019-14283 at NVD SUSE bug 1143191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. Moderate CVE-2019-14287 at SUSE CVE-2019-14287 at NVD SUSE bug 1153674 SUSE bug 1156093 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. Moderate CVE-2019-14378 at SUSE CVE-2019-14378 at NVD SUSE bug 1143794 SUSE bug 1143797 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. Moderate CVE-2019-14494 at SUSE CVE-2019-14494 at NVD SUSE bug 1143950 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file. Important CVE-2019-14744 at SUSE CVE-2019-14744 at NVD SUSE bug 1144600 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. Moderate CVE-2019-14811 at SUSE CVE-2019-14811 at NVD SUSE bug 1146882 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. Moderate CVE-2019-14812 at SUSE CVE-2019-14812 at NVD SUSE bug 1146882 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. Moderate CVE-2019-14813 at SUSE CVE-2019-14813 at NVD SUSE bug 1146882 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code. Moderate CVE-2019-14816 at SUSE CVE-2019-14816 at NVD SUSE bug 1146516 SUSE bug 1173666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. Moderate CVE-2019-14817 at SUSE CVE-2019-14817 at NVD SUSE bug 1146882 SUSE bug 1146884 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system. Moderate CVE-2019-14821 at SUSE CVE-2019-14821 at NVD SUSE bug 1151350 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user. Important CVE-2019-14822 at SUSE CVE-2019-14822 at NVD SUSE bug 1150011 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle. Important CVE-2019-14823 at SUSE CVE-2019-14823 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. Moderate CVE-2019-14824 at SUSE CVE-2019-14824 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation. Moderate CVE-2019-14834 at SUSE CVE-2019-14834 at NVD SUSE bug 1154849 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host. Moderate CVE-2019-14835 at SUSE CVE-2019-14835 at NVD SUSE bug 1150112 SUSE bug 1151021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side. Low CVE-2019-14850 at SUSE CVE-2019-14850 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. Moderate CVE-2019-14857 at SUSE CVE-2019-14857 at NVD SUSE bug 1153666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system. Moderate CVE-2019-14866 at SUSE CVE-2019-14866 at NVD SUSE bug 1155199 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server. Important CVE-2019-14867 at SUSE CVE-2019-14867 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. Important CVE-2019-14868 at SUSE CVE-2019-14868 at NVD SUSE bug 1160796 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands. Important CVE-2019-14869 at SUSE CVE-2019-14869 at NVD SUSE bug 1156275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code. Important CVE-2019-14895 at SUSE CVE-2019-14895 at NVD SUSE bug 1157042 SUSE bug 1157158 SUSE bug 1173100 SUSE bug 1173660 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls. Moderate CVE-2019-14898 at SUSE CVE-2019-14898 at NVD SUSE bug 1157905 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system. Important CVE-2019-14901 at SUSE CVE-2019-14901 at NVD SUSE bug 1157042 SUSE bug 1173661 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code. Critical CVE-2019-14906 at SUSE CVE-2019-14906 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless). Moderate CVE-2019-14907 at SUSE CVE-2019-14907 at NVD SUSE bug 1160888 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. Moderate CVE-2019-14973 at SUSE CVE-2019-14973 at NVD SUSE bug 1146608 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file. Low CVE-2019-14980 at SUSE CVE-2019-14980 at NVD SUSE bug 1146068 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. Low CVE-2019-14981 at SUSE CVE-2019-14981 at NVD SUSE bug 1146065 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472. Low CVE-2019-15139 at SUSE CVE-2019-15139 at NVD SUSE bug 1146213 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c. Low CVE-2019-15140 at SUSE CVE-2019-15140 at NVD SUSE bug 1146212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597. Low CVE-2019-15141 at SUSE CVE-2019-15141 at NVD SUSE bug 1146211 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver. Moderate CVE-2019-15217 at SUSE CVE-2019-15217 at NVD SUSE bug 1146519 SUSE bug 1146547 SUSE bug 1158381 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139. Moderate CVE-2019-15239 at SUSE CVE-2019-15239 at NVD SUSE bug 1146589 SUSE bug 1156317 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). Low CVE-2019-1559 at SUSE CVE-2019-1559 at NVD SUSE bug 1127080 SUSE bug 1130039 SUSE bug 1141798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed Important CVE-2019-15605 at SUSE CVE-2019-15605 at NVD SUSE bug 1163102 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution. Important CVE-2019-15690 at SUSE CVE-2019-15690 at NVD SUSE bug 1160471 SUSE bug 1170441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Important CVE-2019-15691 at SUSE CVE-2019-15691 at NVD SUSE bug 1159856 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Important CVE-2019-15692 at SUSE CVE-2019-15692 at NVD SUSE bug 1160250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Important CVE-2019-15693 at SUSE CVE-2019-15693 at NVD SUSE bug 1159858 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Important CVE-2019-15694 at SUSE CVE-2019-15694 at NVD SUSE bug 1160251 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Important CVE-2019-15695 at SUSE CVE-2019-15695 at NVD SUSE bug 1159860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service. Moderate CVE-2019-15807 at SUSE CVE-2019-15807 at NVD SUSE bug 1148938 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. Important CVE-2019-15903 at SUSE CVE-2019-15903 at NVD SUSE bug 1149429 SUSE bug 1154738 SUSE bug 1154806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. Low CVE-2019-15916 at SUSE CVE-2019-15916 at NVD SUSE bug 1149448 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c. Important CVE-2019-15917 at SUSE CVE-2019-15917 at NVD SUSE bug 1149539 SUSE bug 1156334 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally. Moderate CVE-2019-16056 at SUSE CVE-2019-16056 at NVD SUSE bug 1149955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Moderate CVE-2019-16231 at SUSE CVE-2019-16231 at NVD SUSE bug 1150466 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Moderate CVE-2019-16233 at SUSE CVE-2019-16233 at NVD SUSE bug 1150457 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. Low CVE-2019-16707 at SUSE CVE-2019-16707 at NVD SUSE bug 1151867 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. Moderate CVE-2019-16708 at SUSE CVE-2019-16708 at NVD SUSE bug 1151781 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. Moderate CVE-2019-16709 at SUSE CVE-2019-16709 at NVD SUSE bug 1151782 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c. Moderate CVE-2019-16710 at SUSE CVE-2019-16710 at NVD SUSE bug 1151783 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. Moderate CVE-2019-16711 at SUSE CVE-2019-16711 at NVD SUSE bug 1151784 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image. Moderate CVE-2019-16712 at SUSE CVE-2019-16712 at NVD SUSE bug 1151785 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. Moderate CVE-2019-16713 at SUSE CVE-2019-16713 at NVD SUSE bug 1151786 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow. Moderate CVE-2019-16746 at SUSE CVE-2019-16746 at NVD SUSE bug 1152107 SUSE bug 1173659 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. Moderate CVE-2019-16865 at SUSE CVE-2019-16865 at NVD SUSE bug 1153191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. Moderate CVE-2019-16935 at SUSE CVE-2019-16935 at NVD SUSE bug 1153238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a. Moderate CVE-2019-16994 at SUSE CVE-2019-16994 at NVD SUSE bug 1161523 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-17005 at SUSE CVE-2019-17005 at NVD SUSE bug 1158328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow. Moderate CVE-2019-17006 at SUSE CVE-2019-17006 at NVD SUSE bug 1159819 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-17008 at SUSE CVE-2019-17008 at NVD SUSE bug 1158328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-17010 at SUSE CVE-2019-17010 at NVD SUSE bug 1158328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-17011 at SUSE CVE-2019-17011 at NVD SUSE bug 1158328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Important CVE-2019-17012 at SUSE CVE-2019-17012 at NVD SUSE bug 1158328 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Important CVE-2019-17016 at SUSE CVE-2019-17016 at NVD SUSE bug 1160305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Important CVE-2019-17017 at SUSE CVE-2019-17017 at NVD SUSE bug 1160305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Important CVE-2019-17022 at SUSE CVE-2019-17022 at NVD SUSE bug 1160305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72. Important CVE-2019-17023 at SUSE CVE-2019-17023 at NVD SUSE bug 1160305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Important CVE-2019-17024 at SUSE CVE-2019-17024 at NVD SUSE bug 1160305 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. Important CVE-2019-17026 at SUSE CVE-2019-17026 at NVD SUSE bug 1160498 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. Moderate CVE-2019-17041 at SUSE CVE-2019-17041 at NVD SUSE bug 1153451 SUSE bug 1198831 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. Moderate CVE-2019-17042 at SUSE CVE-2019-17042 at NVD SUSE bug 1153459 SUSE bug 1198831 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7. Moderate CVE-2019-17053 at SUSE CVE-2019-17053 at NVD SUSE bug 1152789 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21. Moderate CVE-2019-17055 at SUSE CVE-2019-17055 at NVD SUSE bug 1152782 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. Moderate CVE-2019-17133 at SUSE CVE-2019-17133 at NVD SUSE bug 1153158 SUSE bug 1153161 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack. Important CVE-2019-17185 at SUSE CVE-2019-17185 at NVD SUSE bug 1166847 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size. Low CVE-2019-17402 at SUSE CVE-2019-17402 at NVD SUSE bug 1153577 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. Moderate CVE-2019-17498 at SUSE CVE-2019-17498 at NVD SUSE bug 1154862 SUSE bug 1171566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. Moderate CVE-2019-17540 at SUSE CVE-2019-17540 at NVD SUSE bug 1153866 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c. Moderate CVE-2019-17541 at SUSE CVE-2019-17541 at NVD SUSE bug 1153867 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition. Important CVE-2019-17546 at SUSE CVE-2019-17546 at NVD SUSE bug 1154365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. Low CVE-2019-17563 at SUSE CVE-2019-17563 at NVD SUSE bug 1159729 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code. Important CVE-2019-17626 at SUSE CVE-2019-17626 at NVD SUSE bug 1154370 SUSE bug 1215560 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. Moderate CVE-2019-17666 at SUSE CVE-2019-17666 at NVD SUSE bug 1154372 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. Important CVE-2019-18197 at SUSE CVE-2019-18197 at NVD SUSE bug 1154609 SUSE bug 1157028 SUSE bug 1162833 SUSE bug 1169511 SUSE bug 1190108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code. Moderate CVE-2019-18282 at SUSE CVE-2019-18282 at NVD SUSE bug 1161121 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat. Important CVE-2019-18397 at SUSE CVE-2019-18397 at NVD SUSE bug 1156260 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol. Moderate CVE-2019-18408 at SUSE CVE-2019-18408 at NVD SUSE bug 1155079 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer. Important CVE-2019-18609 at SUSE CVE-2019-18609 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c. Important CVE-2019-18634 at SUSE CVE-2019-18634 at NVD SUSE bug 1162202 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. Moderate CVE-2019-18660 at SUSE CVE-2019-18660 at NVD SUSE bug 1157038 SUSE bug 1157923 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247. Moderate CVE-2019-18808 at SUSE CVE-2019-18808 at NVD SUSE bug 1156259 SUSE bug 1189884 SUSE bug 1190534 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time Moderate CVE-2019-19046 at SUSE CVE-2019-19046 at NVD SUSE bug 1157304 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred Important CVE-2019-19055 at SUSE CVE-2019-19055 at NVD SUSE bug 1157319 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5. Moderate CVE-2019-19058 at SUSE CVE-2019-19058 at NVD SUSE bug 1157145 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa. Moderate CVE-2019-19059 at SUSE CVE-2019-19059 at NVD SUSE bug 1157296 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042. Moderate CVE-2019-19062 at SUSE CVE-2019-19062 at NVD SUSE bug 1157333 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113. Moderate CVE-2019-19063 at SUSE CVE-2019-19063 at NVD SUSE bug 1157298 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program. Low CVE-2019-19126 at SUSE CVE-2019-19126 at NVD SUSE bug 1157292 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service. Moderate CVE-2019-19332 at SUSE CVE-2019-19332 at NVD SUSE bug 1158827 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability. Moderate CVE-2019-19338 at SUSE CVE-2019-19338 at NVD SUSE bug 1158954 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c. Important CVE-2019-19447 at SUSE CVE-2019-19447 at NVD SUSE bug 1158819 SUSE bug 1173869 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626. Important CVE-2019-19450 at SUSE CVE-2019-19450 at NVD SUSE bug 1215560 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79. Moderate CVE-2019-19523 at SUSE CVE-2019-19523 at NVD SUSE bug 1158381 SUSE bug 1158823 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. Low CVE-2019-19524 at SUSE CVE-2019-19524 at NVD SUSE bug 1158381 SUSE bug 1158413 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e. Moderate CVE-2019-19527 at SUSE CVE-2019-19527 at NVD SUSE bug 1158381 SUSE bug 1158834 SUSE bug 1158900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef. Moderate CVE-2019-19530 at SUSE CVE-2019-19530 at NVD SUSE bug 1158381 SUSE bug 1158410 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c. Moderate CVE-2019-19532 at SUSE CVE-2019-19532 at NVD SUSE bug 1158381 SUSE bug 1158823 SUSE bug 1158824 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29. Low CVE-2019-19534 at SUSE CVE-2019-19534 at NVD SUSE bug 1158381 SUSE bug 1158398 SUSE bug 1158834 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c. Moderate CVE-2019-19537 at SUSE CVE-2019-19537 at NVD SUSE bug 1158381 SUSE bug 1158834 SUSE bug 1158904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163. Moderate CVE-2019-19767 at SUSE CVE-2019-19767 at NVD SUSE bug 1159297 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer). Moderate CVE-2019-19768 at SUSE CVE-2019-19768 at NVD SUSE bug 1159285 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring. Important CVE-2019-19807 at SUSE CVE-2019-19807 at NVD SUSE bug 1159281 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c. Important CVE-2019-19948 at SUSE CVE-2019-19948 at NVD SUSE bug 1159861 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. Moderate CVE-2019-19949 at SUSE CVE-2019-19949 at NVD SUSE bug 1160369 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Moderate CVE-2019-19956 at SUSE CVE-2019-19956 at NVD SUSE bug 1159928 SUSE bug 1191860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). Important CVE-2019-20044 at SUSE CVE-2019-20044 at NVD SUSE bug 1163882 SUSE bug 1200039 SUSE bug 1200202 SUSE bug 1200209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e. Moderate CVE-2019-20054 at SUSE CVE-2019-20054 at NVD SUSE bug 1159910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service. Important CVE-2019-20095 at SUSE CVE-2019-20095 at NVD SUSE bug 1159909 SUSE bug 1159914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. Moderate CVE-2019-20382 at SUSE CVE-2019-20382 at NVD SUSE bug 1165776 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. Low CVE-2019-20386 at SUSE CVE-2019-20386 at NVD SUSE bug 1161436 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. Low CVE-2019-20388 at SUSE CVE-2019-20388 at NVD SUSE bug 1161521 SUSE bug 1191860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. Moderate CVE-2019-20479 at SUSE CVE-2019-20479 at NVD SUSE bug 1164459 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). Moderate CVE-2019-20485 at SUSE CVE-2019-20485 at NVD SUSE bug 1165616 SUSE bug 1168683 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. Important CVE-2019-20503 at SUSE CVE-2019-20503 at NVD SUSE bug 1166238 SUSE bug 1167090 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. Moderate CVE-2019-20636 at SUSE CVE-2019-20636 at NVD SUSE bug 1168075 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c. Moderate CVE-2019-20811 at SUSE CVE-2019-20811 at NVD SUSE bug 1172456 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Moderate CVE-2019-20907 at SUSE CVE-2019-20907 at NVD SUSE bug 1174091 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. Moderate CVE-2019-20916 at SUSE CVE-2019-20916 at NVD SUSE bug 1176262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c. Important CVE-2019-20934 at SUSE CVE-2019-20934 at NVD SUSE bug 1179663 SUSE bug 1179666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Moderate CVE-2019-2422 at SUSE CVE-2019-2422 at NVD SUSE bug 1122293 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. Moderate CVE-2019-25013 at SUSE CVE-2019-25013 at NVD SUSE bug 1182117 SUSE bug 1220988 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H). Important CVE-2019-2503 at SUSE CVE-2019-2503 at NVD SUSE bug 1122198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Important CVE-2019-2529 at SUSE CVE-2019-2529 at NVD SUSE bug 1122198 SUSE bug 1136037 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2019-2602 at SUSE CVE-2019-2602 at NVD SUSE bug 1132728 SUSE bug 1134718 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Important CVE-2019-2614 at SUSE CVE-2019-2614 at NVD SUSE bug 1132826 SUSE bug 1136035 SUSE bug 1141798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Important CVE-2019-2627 at SUSE CVE-2019-2627 at NVD SUSE bug 1132826 SUSE bug 1136035 SUSE bug 1141798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Moderate CVE-2019-2684 at SUSE CVE-2019-2684 at NVD SUSE bug 1132732 SUSE bug 1134718 SUSE bug 1184734 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2019-2698 at SUSE CVE-2019-2698 at NVD SUSE bug 1132729 SUSE bug 1134718 SUSE bug 1163365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2019-2737 at SUSE CVE-2019-2737 at NVD SUSE bug 1132826 SUSE bug 1141798 SUSE bug 1156669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Moderate CVE-2019-2739 at SUSE CVE-2019-2739 at NVD SUSE bug 1132826 SUSE bug 1141798 SUSE bug 1156669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2019-2740 at SUSE CVE-2019-2740 at NVD SUSE bug 1132826 SUSE bug 1141798 SUSE bug 1156669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2019-2745 at SUSE CVE-2019-2745 at NVD SUSE bug 1141784 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2762 at SUSE CVE-2019-2762 at NVD SUSE bug 1141782 SUSE bug 1147021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2769 at SUSE CVE-2019-2769 at NVD SUSE bug 1141783 SUSE bug 1147021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Moderate CVE-2019-2786 at SUSE CVE-2019-2786 at NVD SUSE bug 1141787 SUSE bug 1147021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2019-2805 at SUSE CVE-2019-2805 at NVD SUSE bug 1132826 SUSE bug 1141798 SUSE bug 1156669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Moderate CVE-2019-2816 at SUSE CVE-2019-2816 at NVD SUSE bug 1141785 SUSE bug 1147021 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Moderate CVE-2019-2818 at SUSE CVE-2019-2818 at NVD SUSE bug 1141788 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Moderate CVE-2019-2821 at SUSE CVE-2019-2821 at NVD SUSE bug 1141781 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2842 at SUSE CVE-2019-2842 at NVD SUSE bug 1141786 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). Moderate CVE-2019-2945 at SUSE CVE-2019-2945 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Moderate CVE-2019-2949 at SUSE CVE-2019-2949 at NVD SUSE bug 1154212 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2962 at SUSE CVE-2019-2962 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2964 at SUSE CVE-2019-2964 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2973 at SUSE CVE-2019-2973 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2019-2974 at SUSE CVE-2019-2974 at NVD SUSE bug 1154162 SUSE bug 1156669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Moderate CVE-2019-2975 at SUSE CVE-2019-2975 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L). Moderate CVE-2019-2977 at SUSE CVE-2019-2977 at NVD SUSE bug 1154212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2978 at SUSE CVE-2019-2978 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2981 at SUSE CVE-2019-2981 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2983 at SUSE CVE-2019-2983 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2987 at SUSE CVE-2019-2987 at NVD SUSE bug 1154212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2988 at SUSE CVE-2019-2988 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 6.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N). Moderate CVE-2019-2989 at SUSE CVE-2019-2989 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2019-2992 at SUSE CVE-2019-2992 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Moderate CVE-2019-2999 at SUSE CVE-2019-2999 at NVD SUSE bug 1154212 SUSE bug 1158442 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1. Moderate CVE-2019-3459 at SUSE CVE-2019-3459 at NVD SUSE bug 1120758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1. Moderate CVE-2019-3460 at SUSE CVE-2019-3460 at NVD SUSE bug 1120758 SUSE bug 1155131 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1. Important CVE-2019-3695 at SUSE CVE-2019-3695 at NVD SUSE bug 1152533 SUSE bug 1152763 SUSE bug 1154062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1. Important CVE-2019-3696 at SUSE CVE-2019-3696 at NVD SUSE bug 1152533 SUSE bug 1153921 SUSE bug 1154062 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. Moderate CVE-2019-3811 at SUSE CVE-2019-3811 at NVD SUSE bug 1121759 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Important CVE-2019-3813 at SUSE CVE-2019-3813 at NVD SUSE bug 1122706 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users. Important CVE-2019-3814 at SUSE CVE-2019-3814 at NVD SUSE bug 1123022 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2. Low CVE-2019-3815 at SUSE CVE-2019-3815 at NVD SUSE bug 1108912 SUSE bug 1120323 SUSE bug 1122265 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server. Important CVE-2019-3816 at SUSE CVE-2019-3816 at NVD SUSE bug 1122623 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. Moderate CVE-2019-3820 at SUSE CVE-2019-3820 at NVD SUSE bug 1124493 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration. CVE-2019-3827 at SUSE CVE-2019-3827 at NVD SUSE bug 1125084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server. Important CVE-2019-3833 at SUSE CVE-2019-3833 at NVD SUSE bug 1122623 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Important CVE-2019-3835 at SUSE CVE-2019-3835 at NVD SUSE bug 1129180 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Important CVE-2019-3838 at SUSE CVE-2019-3838 at NVD SUSE bug 1018128 SUSE bug 1030263 SUSE bug 1032135 SUSE bug 1038835 SUSE bug 1050888 SUSE bug 1050889 SUSE bug 1106171 SUSE bug 1106172 SUSE bug 1106173 SUSE bug 1107422 SUSE bug 1107423 SUSE bug 1107581 SUSE bug 1111479 SUSE bug 1112229 SUSE bug 1114495 SUSE bug 1117022 SUSE bug 1117327 SUSE bug 1118318 SUSE bug 1129180 SUSE bug 1129186 SUSE bug 1136756 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable. Important CVE-2019-3839 at SUSE CVE-2019-3839 at NVD SUSE bug 1134156 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service. Moderate CVE-2019-3840 at SUSE CVE-2019-3840 at NVD SUSE bug 1127458 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. Moderate CVE-2019-3846 at SUSE CVE-2019-3846 at NVD SUSE bug 1136424 SUSE bug 1136446 SUSE bug 1156330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Moderate CVE-2019-3855 at SUSE CVE-2019-3855 at NVD SUSE bug 1128471 SUSE bug 1134329 SUSE bug 1135434 SUSE bug 1141850 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Moderate CVE-2019-3856 at SUSE CVE-2019-3856 at NVD SUSE bug 1128472 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. Moderate CVE-2019-3857 at SUSE CVE-2019-3857 at NVD SUSE bug 1128474 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Moderate CVE-2019-3858 at SUSE CVE-2019-3858 at NVD SUSE bug 1128476 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Moderate CVE-2019-3861 at SUSE CVE-2019-3861 at NVD SUSE bug 1128490 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Moderate CVE-2019-3862 at SUSE CVE-2019-3862 at NVD SUSE bug 1128492 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error. Moderate CVE-2019-3863 at SUSE CVE-2019-3863 at NVD SUSE bug 1128493 SUSE bug 1130103 SUSE bug 1135434 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function. Moderate CVE-2019-3877 at SUSE CVE-2019-3877 at NVD SUSE bug 1153666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication. Important CVE-2019-3878 at SUSE CVE-2019-3878 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Moderate CVE-2019-3880 at SUSE CVE-2019-3880 at NVD SUSE bug 1131060 SUSE bug 1139519 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable. Moderate CVE-2019-3882 at SUSE CVE-2019-3882 at NVD SUSE bug 1131416 SUSE bug 1131427 SUSE bug 1133319 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service. Moderate CVE-2019-3883 at SUSE CVE-2019-3883 at NVD SUSE bug 1132385 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference. Moderate CVE-2019-3890 at SUSE CVE-2019-3890 at NVD SUSE bug 1131359 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario. Low CVE-2019-3900 at SUSE CVE-2019-3900 at NVD SUSE bug 1133374 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8. Low CVE-2019-3901 at SUSE CVE-2019-3901 at NVD SUSE bug 1132374 SUSE bug 1133106 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. Moderate CVE-2019-5010 at SUSE CVE-2019-5010 at NVD SUSE bug 1122191 SUSE bug 1126909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Moderate CVE-2019-5094 at SUSE CVE-2019-5094 at NVD SUSE bug 1152101 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Moderate CVE-2019-5188 at SUSE CVE-2019-5188 at NVD SUSE bug 1160571 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Important CVE-2019-5436 at SUSE CVE-2019-5436 at NVD SUSE bug 1135170 SUSE bug 1149496 SUSE bug 1154162 SUSE bug 1167096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Important CVE-2019-5482 at SUSE CVE-2019-5482 at NVD SUSE bug 1149496 SUSE bug 1156634 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. Moderate CVE-2019-5489 at SUSE CVE-2019-5489 at NVD SUSE bug 1120843 SUSE bug 1120885 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Critical CVE-2019-5544 at SUSE CVE-2019-5544 at NVD SUSE bug 1157869 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Moderate CVE-2019-5785 at SUSE CVE-2019-5785 at NVD SUSE bug 1125330 SUSE bug 1125396 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Moderate CVE-2019-5798 at SUSE CVE-2019-5798 at NVD SUSE bug 1129059 SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors. Important CVE-2019-5953 at SUSE CVE-2019-5953 at NVD SUSE bug 1131493 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. Moderate CVE-2019-6109 at SUSE CVE-2019-6109 at NVD SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 SUSE bug 1138392 SUSE bug 1144902 SUSE bug 1144903 SUSE bug 1148884 SUSE Liberty Linux 7 LTSS In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Moderate CVE-2019-6110 at SUSE CVE-2019-6110 at NVD SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Moderate CVE-2019-6111 at SUSE CVE-2019-6111 at NVD SUSE bug 1121571 SUSE bug 1121816 SUSE bug 1121818 SUSE bug 1121821 SUSE bug 1123028 SUSE bug 1123220 SUSE bug 1131109 SUSE bug 1138392 SUSE bug 1144902 SUSE bug 1144903 SUSE bug 1148884 SUSE bug 1201840 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. Moderate CVE-2019-6116 at SUSE CVE-2019-6116 at NVD SUSE bug 1122319 SUSE bug 1129186 SUSE bug 1134156 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. Moderate CVE-2019-6133 at SUSE CVE-2019-6133 at NVD SUSE bug 1070943 SUSE bug 1121826 SUSE bug 1121872 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-6237 at SUSE CVE-2019-6237 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. Important CVE-2019-6251 at SUSE CVE-2019-6251 at NVD SUSE bug 1121894 SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic). Important CVE-2019-6454 at SUSE CVE-2019-6454 at NVD SUSE bug 1125352 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465. Moderate CVE-2019-6465 at SUSE CVE-2019-6465 at NVD SUSE bug 1126069 SUSE bug 1141730 SUSE bug 1148887 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation. Important CVE-2019-6470 at SUSE CVE-2019-6470 at NVD SUSE bug 1134078 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem). Important CVE-2019-6477 at SUSE CVE-2019-6477 at NVD SUSE bug 1157051 SUSE bug 1197136 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. Important CVE-2019-6778 at SUSE CVE-2019-6778 at NVD SUSE bug 1123156 SUSE bug 1123157 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. Moderate CVE-2019-6974 at SUSE CVE-2019-6974 at NVD SUSE bug 1124728 SUSE bug 1124729 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. Moderate CVE-2019-6978 at SUSE CVE-2019-6978 at NVD SUSE bug 1123522 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm. Moderate CVE-2019-7149 at SUSE CVE-2019-7149 at NVD SUSE bug 1123559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Low CVE-2019-7150 at SUSE CVE-2019-7150 at NVD SUSE bug 1123685 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. Low CVE-2019-7175 at SUSE CVE-2019-7175 at NVD SUSE bug 1128649 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. Moderate CVE-2019-7221 at SUSE CVE-2019-7221 at NVD SUSE bug 1124732 SUSE bug 1124734 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. Low CVE-2019-7222 at SUSE CVE-2019-7222 at NVD SUSE bug 1124735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. Moderate CVE-2019-7310 at SUSE CVE-2019-7310 at NVD SUSE bug 1124150 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. Moderate CVE-2019-7317 at SUSE CVE-2019-7317 at NVD SUSE bug 1124211 SUSE bug 1135824 SUSE bug 1141780 SUSE bug 1147021 SUSE bug 1165297 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. Low CVE-2019-7397 at SUSE CVE-2019-7397 at NVD SUSE bug 1124366 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. Low CVE-2019-7398 at SUSE CVE-2019-7398 at NVD SUSE bug 1124365 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components. Moderate CVE-2019-7524 at SUSE CVE-2019-7524 at NVD SUSE bug 1130116 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c. CVE-2019-7572 at SUSE CVE-2019-7572 at NVD SUSE bug 1124806 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). Moderate CVE-2019-7573 at SUSE CVE-2019-7573 at NVD SUSE bug 1124805 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c. Moderate CVE-2019-7574 at SUSE CVE-2019-7574 at NVD SUSE bug 1124803 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c. Moderate CVE-2019-7575 at SUSE CVE-2019-7575 at NVD SUSE bug 1124802 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). Moderate CVE-2019-7576 at SUSE CVE-2019-7576 at NVD SUSE bug 1124799 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c. Moderate CVE-2019-7577 at SUSE CVE-2019-7577 at NVD SUSE bug 1124800 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c. Moderate CVE-2019-7578 at SUSE CVE-2019-7578 at NVD SUSE bug 1125099 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. Moderate CVE-2019-7635 at SUSE CVE-2019-7635 at NVD SUSE bug 1124827 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c. Moderate CVE-2019-7636 at SUSE CVE-2019-7636 at NVD SUSE bug 1124826 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. Moderate CVE-2019-7637 at SUSE CVE-2019-7637 at NVD SUSE bug 1124825 SUSE bug 1134135 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c. Moderate CVE-2019-7638 at SUSE CVE-2019-7638 at NVD SUSE bug 1124824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). Low CVE-2019-7664 at SUSE CVE-2019-7664 at NVD SUSE bug 1125008 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. Low CVE-2019-7665 at SUSE CVE-2019-7665 at NVD SUSE bug 1125007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. Important CVE-2019-8308 at SUSE CVE-2019-8308 at NVD SUSE bug 1125431 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. Important CVE-2019-8322 at SUSE CVE-2019-8322 at NVD SUSE bug 1130622 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. Important CVE-2019-8323 at SUSE CVE-2019-8323 at NVD SUSE bug 1130620 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. Important CVE-2019-8324 at SUSE CVE-2019-8324 at NVD SUSE bug 1130617 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) Important CVE-2019-8325 at SUSE CVE-2019-8325 at NVD SUSE bug 1130611 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. Moderate CVE-2019-8331 at SUSE CVE-2019-8331 at NVD SUSE bug 1247983 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file. Important CVE-2019-8379 at SUSE CVE-2019-8379 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file. Important CVE-2019-8383 at SUSE CVE-2019-8383 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8506 at SUSE CVE-2019-8506 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8524 at SUSE CVE-2019-8524 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8535 at SUSE CVE-2019-8535 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8536 at SUSE CVE-2019-8536 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8544 at SUSE CVE-2019-8544 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to universal cross site scripting. Moderate CVE-2019-8551 at SUSE CVE-2019-8551 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8558 at SUSE CVE-2019-8558 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8559 at SUSE CVE-2019-8559 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8563 at SUSE CVE-2019-8563 at NVD SUSE bug 1132256 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8571 at SUSE CVE-2019-8571 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8583 at SUSE CVE-2019-8583 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8584 at SUSE CVE-2019-8584 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8586 at SUSE CVE-2019-8586 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8587 at SUSE CVE-2019-8587 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8594 at SUSE CVE-2019-8594 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8595 at SUSE CVE-2019-8595 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8596 at SUSE CVE-2019-8596 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8597 at SUSE CVE-2019-8597 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8601 at SUSE CVE-2019-8601 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory. Low CVE-2019-8607 at SUSE CVE-2019-8607 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8608 at SUSE CVE-2019-8608 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8609 at SUSE CVE-2019-8609 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8610 at SUSE CVE-2019-8610 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8611 at SUSE CVE-2019-8611 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8615 at SUSE CVE-2019-8615 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8619 at SUSE CVE-2019-8619 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8622 at SUSE CVE-2019-8622 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution. Low CVE-2019-8623 at SUSE CVE-2019-8623 at NVD SUSE bug 1135715 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2019-8625 at SUSE CVE-2019-8625 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8644 at SUSE CVE-2019-8644 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting. Moderate CVE-2019-8649 at SUSE CVE-2019-8649 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting. Moderate CVE-2019-8658 at SUSE CVE-2019-8658 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8666 at SUSE CVE-2019-8666 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8669 at SUSE CVE-2019-8669 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8671 at SUSE CVE-2019-8671 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8672 at SUSE CVE-2019-8672 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8673 at SUSE CVE-2019-8673 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2019-8674 at SUSE CVE-2019-8674 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code. Moderate CVE-2019-8675 at SUSE CVE-2019-8675 at NVD SUSE bug 1146358 SUSE bug 1168422 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8676 at SUSE CVE-2019-8676 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8677 at SUSE CVE-2019-8677 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8678 at SUSE CVE-2019-8678 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8679 at SUSE CVE-2019-8679 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8680 at SUSE CVE-2019-8680 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8681 at SUSE CVE-2019-8681 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8683 at SUSE CVE-2019-8683 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8684 at SUSE CVE-2019-8684 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8686 at SUSE CVE-2019-8686 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8687 at SUSE CVE-2019-8687 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8688 at SUSE CVE-2019-8688 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Moderate CVE-2019-8689 at SUSE CVE-2019-8689 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue existed in the handling of document loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting. Moderate CVE-2019-8690 at SUSE CVE-2019-8690 at NVD SUSE bug 1148931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code. Moderate CVE-2019-8696 at SUSE CVE-2019-8696 at NVD SUSE bug 1146358 SUSE bug 1146359 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8707 at SUSE CVE-2019-8707 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8710 at SUSE CVE-2019-8710 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2019-8719 at SUSE CVE-2019-8719 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues. Important CVE-2019-8720 at SUSE CVE-2019-8720 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8726 at SUSE CVE-2019-8726 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8733 at SUSE CVE-2019-8733 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8735 at SUSE CVE-2019-8735 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8743 at SUSE CVE-2019-8743 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8763 at SUSE CVE-2019-8763 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2019-8764 at SUSE CVE-2019-8764 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8765 at SUSE CVE-2019-8765 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8766 at SUSE CVE-2019-8766 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history items. Important CVE-2019-8768 at SUSE CVE-2019-8768 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history. Important CVE-2019-8769 at SUSE CVE-2019-8769 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy. Important CVE-2019-8771 at SUSE CVE-2019-8771 at NVD SUSE bug 1155321 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8782 at SUSE CVE-2019-8782 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8783 at SUSE CVE-2019-8783 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8808 at SUSE CVE-2019-8808 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8811 at SUSE CVE-2019-8811 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8812 at SUSE CVE-2019-8812 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2019-8813 at SUSE CVE-2019-8813 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8814 at SUSE CVE-2019-8814 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8815 at SUSE CVE-2019-8815 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8816 at SUSE CVE-2019-8816 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8819 at SUSE CVE-2019-8819 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8820 at SUSE CVE-2019-8820 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8821 at SUSE CVE-2019-8821 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8822 at SUSE CVE-2019-8822 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8823 at SUSE CVE-2019-8823 at NVD SUSE bug 1156318 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8835 at SUSE CVE-2019-8835 at NVD SUSE bug 1161719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8844 at SUSE CVE-2019-8844 at NVD SUSE bug 1161719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2019-8846 at SUSE CVE-2019-8846 at NVD SUSE bug 1161719 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. Moderate CVE-2019-9024 at SUSE CVE-2019-9024 at NVD SUSE bug 1126821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Important CVE-2019-9200 at SUSE CVE-2019-9200 at NVD SUSE bug 1127329 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.) Important CVE-2019-9210 at SUSE CVE-2019-9210 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483 Moderate CVE-2019-9232 at SUSE CVE-2019-9232 at NVD SUSE bug 1160613 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774 Important CVE-2019-9278 at SUSE CVE-2019-9278 at NVD SUSE bug 1160770 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-80479354 Moderate CVE-2019-9433 at SUSE CVE-2019-9433 at NVD SUSE bug 1160614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Moderate CVE-2019-9454 at SUSE CVE-2019-9454 at NVD SUSE bug 1150023 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Important CVE-2019-9458 at SUSE CVE-2019-9458 at NVD SUSE bug 1168295 SUSE bug 1173963 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. Low CVE-2019-9500 at SUSE CVE-2019-9500 at NVD SUSE bug 1132681 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. Moderate CVE-2019-9503 at SUSE CVE-2019-9503 at NVD SUSE bug 1132673 SUSE bug 1132828 SUSE bug 1133319 SUSE bug 1156653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing. Moderate CVE-2019-9506 at SUSE CVE-2019-9506 at NVD SUSE bug 1137865 SUSE bug 1146042 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. Low CVE-2019-9631 at SUSE CVE-2019-9631 at NVD SUSE bug 1129202 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Moderate CVE-2019-9636 at SUSE CVE-2019-9636 at NVD SUSE bug 1129346 SUSE bug 1135433 SUSE bug 1138459 SUSE bug 1145004 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Moderate CVE-2019-9740 at SUSE CVE-2019-9740 at NVD SUSE bug 1129071 SUSE bug 1130840 SUSE bug 1132663 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. Moderate CVE-2019-9755 at SUSE CVE-2019-9755 at NVD SUSE bug 1130165 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9788 at SUSE CVE-2019-9788 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9790 at SUSE CVE-2019-9790 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9791 at SUSE CVE-2019-9791 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9792 at SUSE CVE-2019-9792 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9793 at SUSE CVE-2019-9793 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9795 at SUSE CVE-2019-9795 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Important CVE-2019-9796 at SUSE CVE-2019-9796 at NVD SUSE bug 1129821 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66. Important CVE-2019-9797 at SUSE CVE-2019-9797 at NVD SUSE bug 1129821 SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-9800 at SUSE CVE-2019-9800 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1. Moderate CVE-2019-9810 at SUSE CVE-2019-9810 at NVD SUSE bug 1129821 SUSE bug 1130262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Important CVE-2019-9811 at SUSE CVE-2019-9811 at NVD SUSE bug 1140868 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69. Important CVE-2019-9812 at SUSE CVE-2019-9812 at NVD SUSE bug 1149294 SUSE bug 1149323 SUSE bug 1149324 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1. Moderate CVE-2019-9813 at SUSE CVE-2019-9813 at NVD SUSE bug 1129821 SUSE bug 1130262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-9816 at SUSE CVE-2019-9816 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-9817 at SUSE CVE-2019-9817 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-9819 at SUSE CVE-2019-9819 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Important CVE-2019-9820 at SUSE CVE-2019-9820 at NVD SUSE bug 1135824 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. Low CVE-2019-9824 at SUSE CVE-2019-9824 at NVD SUSE bug 1118900 SUSE bug 1129622 SUSE bug 1129623 SUSE bug 1178658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell. Moderate CVE-2019-9924 at SUSE CVE-2019-9924 at NVD SUSE bug 1130324 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. Moderate CVE-2019-9947 at SUSE CVE-2019-9947 at NVD SUSE bug 1130840 SUSE bug 1136184 SUSE bug 1155094 SUSE bug 1201559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. Low CVE-2019-9948 at SUSE CVE-2019-9948 at NVD SUSE bug 1130847 SUSE bug 1135433 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file. Moderate CVE-2019-9956 at SUSE CVE-2019-9956 at NVD SUSE bug 1130330 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo. Low CVE-2019-9959 at SUSE CVE-2019-9959 at NVD SUSE bug 1142465 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770 Moderate CVE-2020-0034 at SUSE CVE-2020-0034 at NVD SUSE bug 1166066 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132 Moderate CVE-2020-0093 at SUSE CVE-2020-0093 at NVD SUSE bug 1171847 SUSE bug 1172116 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917 Moderate CVE-2020-0182 at SUSE CVE-2020-0182 at NVD SUSE bug 1172766 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171 Moderate CVE-2020-0427 at SUSE CVE-2020-0427 at NVD SUSE bug 1176725 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731 Important CVE-2020-0452 at SUSE CVE-2020-0452 at NVD SUSE bug 1178479 SUSE bug 1208307 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel Important CVE-2020-0465 at SUSE CVE-2020-0465 at NVD SUSE bug 1180029 SUSE bug 1180030 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel Important CVE-2020-0466 at SUSE CVE-2020-0466 at NVD SUSE bug 1180031 SUSE bug 1180032 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0543 at SUSE CVE-2020-0543 at NVD SUSE bug 1154824 SUSE bug 1172205 SUSE bug 1172206 SUSE bug 1172207 SUSE bug 1172770 SUSE bug 1178658 SUSE bug 1201877 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0548 at SUSE CVE-2020-0548 at NVD SUSE bug 1156353 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-0549 at SUSE CVE-2020-0549 at NVD SUSE bug 1156353 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access Moderate CVE-2020-0556 at SUSE CVE-2020-0556 at NVD SUSE bug 1166751 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access. Important CVE-2020-0569 at SUSE CVE-2020-0569 at NVD SUSE bug 1161167 SUSE bug 1162191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access. Important CVE-2020-0570 at SUSE CVE-2020-0570 at NVD SUSE bug 1161167 SUSE bug 1162191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling. Moderate CVE-2020-10018 at SUSE CVE-2020-10018 at NVD SUSE bug 1165528 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. Low CVE-2020-10029 at SUSE CVE-2020-10029 at NVD SUSE bug 1165784 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. Important CVE-2020-10108 at SUSE CVE-2020-10108 at NVD SUSE bug 1166457 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. Important CVE-2020-10109 at SUSE CVE-2020-10109 at NVD SUSE bug 1166458 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions. Important CVE-2020-10188 at SUSE CVE-2020-10188 at NVD SUSE bug 1165787 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Important CVE-2020-10531 at SUSE CVE-2020-10531 at NVD SUSE bug 1166844 SUSE bug 1175778 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Moderate CVE-2020-10543 at SUSE CVE-2020-10543 at NVD SUSE bug 1171863 SUSE bug 1225627 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode. Moderate CVE-2020-10690 at SUSE CVE-2020-10690 at NVD SUSE bug 1170056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service. Moderate CVE-2020-10703 at SUSE CVE-2020-10703 at NVD SUSE bug 1168683 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service. Moderate CVE-2020-10711 at SUSE CVE-2020-10711 at NVD SUSE bug 1171191 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data. Low CVE-2020-10732 at SUSE CVE-2020-10732 at NVD SUSE bug 1171220 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the index after one memory allocation by kmalloc will cause a kernel panic. The highest threat from this vulnerability is to data confidentiality and system availability. Moderate CVE-2020-10742 at SUSE CVE-2020-10742 at NVD SUSE bug 1171984 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing. Moderate CVE-2020-10751 at SUSE CVE-2020-10751 at NVD SUSE bug 1171189 SUSE bug 1174963 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely. Moderate CVE-2020-10754 at SUSE CVE-2020-10754 at NVD SUSE bug 1172457 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system. Important CVE-2020-10757 at SUSE CVE-2020-10757 at NVD SUSE bug 1159281 SUSE bug 1172317 SUSE bug 1172437 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service. Moderate CVE-2020-10769 at SUSE CVE-2020-10769 at NVD SUSE bug 1173265 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound. Important CVE-2020-10772 at SUSE CVE-2020-10772 at NVD SUSE bug 1171889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. Moderate CVE-2020-10878 at SUSE CVE-2020-10878 at NVD SUSE bug 1171864 SUSE bug 1225627 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls. Moderate CVE-2020-10942 at SUSE CVE-2020-10942 at NVD SUSE bug 1167629 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability. Moderate CVE-2020-11008 at SUSE CVE-2020-11008 at NVD SUSE bug 1169936 SUSE bug 1170741 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. Important CVE-2020-11018 at SUSE CVE-2020-11018 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. Important CVE-2020-11019 at SUSE CVE-2020-11019 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Moderate CVE-2020-11022 at SUSE CVE-2020-11022 at NVD SUSE bug 1173090 SUSE bug 1178434 SUSE bug 1190663 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Moderate CVE-2020-11023 at SUSE CVE-2020-11023 at NVD SUSE bug 1173090 SUSE bug 1178434 SUSE bug 1190660 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0. Important CVE-2020-11038 at SUSE CVE-2020-11038 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. Important CVE-2020-11039 at SUSE CVE-2020-11039 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0. Important CVE-2020-11040 at SUSE CVE-2020-11040 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0. Important CVE-2020-11041 at SUSE CVE-2020-11041 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0. Important CVE-2020-11042 at SUSE CVE-2020-11042 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0. Important CVE-2020-11043 at SUSE CVE-2020-11043 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. Important CVE-2020-11044 at SUSE CVE-2020-11044 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour. Important CVE-2020-11045 at SUSE CVE-2020-11045 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. Important CVE-2020-11046 at SUSE CVE-2020-11046 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0. Important CVE-2020-11047 at SUSE CVE-2020-11047 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0. Important CVE-2020-11048 at SUSE CVE-2020-11048 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. Important CVE-2020-11049 at SUSE CVE-2020-11049 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0. Important CVE-2020-11058 at SUSE CVE-2020-11058 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. Moderate CVE-2020-11078 at SUSE CVE-2020-11078 at NVD SUSE bug 1171998 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. Important CVE-2020-11085 at SUSE CVE-2020-11085 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. Important CVE-2020-11086 at SUSE CVE-2020-11086 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. Important CVE-2020-11087 at SUSE CVE-2020-11087 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. Important CVE-2020-11088 at SUSE CVE-2020-11088 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. Important CVE-2020-11089 at SUSE CVE-2020-11089 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. Moderate CVE-2020-11522 at SUSE CVE-2020-11522 at NVD SUSE bug 1169413 SUSE bug 1171444 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read. Low CVE-2020-11525 at SUSE CVE-2020-11525 at NVD SUSE bug 1169413 SUSE bug 1171447 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read. Low CVE-2020-11526 at SUSE CVE-2020-11526 at NVD SUSE bug 1169413 SUSE bug 1171674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.” Moderate CVE-2020-11565 at SUSE CVE-2020-11565 at NVD SUSE bug 1168831 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770. Important CVE-2020-11668 at SUSE CVE-2020-11668 at NVD SUSE bug 1168952 SUSE bug 1173942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. Low CVE-2020-11761 at SUSE CVE-2020-11761 at NVD SUSE bug 1169578 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. Low CVE-2020-11763 at SUSE CVE-2020-11763 at NVD SUSE bug 1169576 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. Low CVE-2020-11764 at SUSE CVE-2020-11764 at NVD SUSE bug 1169574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash). Moderate CVE-2020-11793 at SUSE CVE-2020-11793 at NVD SUSE bug 1169658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. Low CVE-2020-11868 at SUSE CVE-2020-11868 at NVD SUSE bug 1169740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials). Important CVE-2020-11945 at SUSE CVE-2020-11945 at NVD SUSE bug 1170313 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Moderate CVE-2020-12049 at SUSE CVE-2020-12049 at NVD SUSE bug 1172505 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. Important CVE-2020-12100 at SUSE CVE-2020-12100 at NVD SUSE bug 1174920 SUSE bug 1180406 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Important CVE-2020-12243 at SUSE CVE-2020-12243 at NVD SUSE bug 1170771 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Critical CVE-2020-12321 at SUSE CVE-2020-12321 at NVD SUSE bug 1178671 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. Important CVE-2020-12362 at SUSE CVE-2020-12362 at NVD SUSE bug 1181720 SUSE bug 1182033 SUSE bug 1190859 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. Moderate CVE-2020-12363 at SUSE CVE-2020-12363 at NVD SUSE bug 1181720 SUSE bug 1181735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. Moderate CVE-2020-12364 at SUSE CVE-2020-12364 at NVD SUSE bug 1181720 SUSE bug 1181736 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. Important CVE-2020-12387 at SUSE CVE-2020-12387 at NVD SUSE bug 1171186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. Important CVE-2020-12392 at SUSE CVE-2020-12392 at NVD SUSE bug 1171186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. Important CVE-2020-12395 at SUSE CVE-2020-12395 at NVD SUSE bug 1171186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. Moderate CVE-2020-12397 at SUSE CVE-2020-12397 at NVD SUSE bug 1171186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0. Important CVE-2020-12398 at SUSE CVE-2020-12398 at NVD SUSE bug 1172402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-12400 at SUSE CVE-2020-12400 at NVD SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-12401 at SUSE CVE-2020-12401 at NVD SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78. Moderate CVE-2020-12402 at SUSE CVE-2020-12402 at NVD SUSE bug 1173032 SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability. Critical CVE-2020-12403 at SUSE CVE-2020-12403 at NVD SUSE bug 1174763 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Important CVE-2020-12405 at SUSE CVE-2020-12405 at NVD SUSE bug 1172402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Important CVE-2020-12406 at SUSE CVE-2020-12406 at NVD SUSE bug 1172402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Important CVE-2020-12410 at SUSE CVE-2020-12410 at NVD SUSE bug 1172402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Important CVE-2020-12417 at SUSE CVE-2020-12417 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Important CVE-2020-12418 at SUSE CVE-2020-12418 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Important CVE-2020-12419 at SUSE CVE-2020-12419 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Important CVE-2020-12420 at SUSE CVE-2020-12420 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Important CVE-2020-12421 at SUSE CVE-2020-12421 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. Important CVE-2020-12422 at SUSE CVE-2020-12422 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Important CVE-2020-12424 at SUSE CVE-2020-12424 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78. Important CVE-2020-12425 at SUSE CVE-2020-12425 at NVD SUSE bug 1173576 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea. Important CVE-2020-12653 at SUSE CVE-2020-12653 at NVD SUSE bug 1159281 SUSE bug 1171195 SUSE bug 1171254 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591. Important CVE-2020-12654 at SUSE CVE-2020-12654 at NVD SUSE bug 1159281 SUSE bug 1171202 SUSE bug 1171252 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. Important CVE-2020-12662 at SUSE CVE-2020-12662 at NVD SUSE bug 1171889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Important CVE-2020-12663 at SUSE CVE-2020-12663 at NVD SUSE bug 1171889 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. Important CVE-2020-12673 at SUSE CVE-2020-12673 at NVD SUSE bug 1174920 SUSE bug 1174922 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. Important CVE-2020-12674 at SUSE CVE-2020-12674 at NVD SUSE bug 1174920 SUSE bug 1174923 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Moderate CVE-2020-12723 at SUSE CVE-2020-12723 at NVD SUSE bug 1171866 SUSE bug 1225627 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. Moderate CVE-2020-12767 at SUSE CVE-2020-12767 at NVD SUSE bug 1171475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040. Moderate CVE-2020-12770 at SUSE CVE-2020-12770 at NVD SUSE bug 1171420 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. Important CVE-2020-12825 at SUSE CVE-2020-12825 at NVD SUSE bug 1171685 SUSE bug 1203730 SUSE bug 1208647 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat. Moderate CVE-2020-12826 at SUSE CVE-2020-12826 at NVD SUSE bug 1171727 SUSE bug 1171985 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space. Moderate CVE-2020-12888 at SUSE CVE-2020-12888 at NVD SUSE bug 1159281 SUSE bug 1171868 SUSE bug 1176979 SUSE bug 1179612 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093. Critical CVE-2020-13112 at SUSE CVE-2020-13112 at NVD SUSE bug 1172116 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions. Important CVE-2020-13113 at SUSE CVE-2020-13113 at NVD SUSE bug 1172105 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data. Moderate CVE-2020-13114 at SUSE CVE-2020-13114 at NVD SUSE bug 1172121 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. Important CVE-2020-13396 at SUSE CVE-2020-13396 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. Important CVE-2020-13397 at SUSE CVE-2020-13397 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. Important CVE-2020-13398 at SUSE CVE-2020-13398 at NVD SUSE bug 1171441 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. Moderate CVE-2020-13692 at SUSE CVE-2020-13692 at NVD SUSE bug 1172746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. Important CVE-2020-13765 at SUSE CVE-2020-13765 at NVD SUSE bug 1172478 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance. Moderate CVE-2020-13817 at SUSE CVE-2020-13817 at NVD SUSE bug 1172651 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). Moderate CVE-2020-13867 at SUSE CVE-2020-13867 at NVD SUSE bug 1172743 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. Important CVE-2020-13935 at SUSE CVE-2020-13935 at NVD SUSE bug 1174117 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved. Moderate CVE-2020-14019 at SUSE CVE-2020-14019 at NVD SUSE bug 1173257 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. Moderate CVE-2020-14145 at SUSE CVE-2020-14145 at NVD SUSE bug 1173513 SUSE bug 1177569 SUSE bug 1189078 SUSE Liberty Linux 7 An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2020-14305 at SUSE CVE-2020-14305 at NVD SUSE bug 1173346 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-14314 at SUSE CVE-2020-14314 at NVD SUSE bug 1173798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Moderate CVE-2020-14318 at SUSE CVE-2020-14318 at NVD SUSE bug 1173902 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. Moderate CVE-2020-14323 at SUSE CVE-2020-14323 at NVD SUSE bug 1173994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14331 at SUSE CVE-2020-14331 at NVD SUSE bug 1174205 SUSE bug 1174247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14345 at SUSE CVE-2020-14345 at NVD SUSE bug 1174635 SUSE bug 1174638 SUSE bug 1174908 SUSE bug 1174910 SUSE bug 1174913 SUSE bug 1177596 SUSE bug 1181067 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14346 at SUSE CVE-2020-14346 at NVD SUSE bug 1174635 SUSE bug 1174638 SUSE bug 1174910 SUSE bug 1174913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable. Moderate CVE-2020-14347 at SUSE CVE-2020-14347 at NVD SUSE bug 1174633 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Moderate CVE-2020-14351 at SUSE CVE-2020-14351 at NVD SUSE bug 1177086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories. Important CVE-2020-14352 at SUSE CVE-2020-14352 at NVD SUSE bug 1175475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution. Moderate CVE-2020-14355 at SUSE CVE-2020-14355 at NVD SUSE bug 1177158 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14360 at SUSE CVE-2020-14360 at NVD SUSE bug 1174908 SUSE bug 1177596 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14361 at SUSE CVE-2020-14361 at NVD SUSE bug 1174635 SUSE bug 1174638 SUSE bug 1174910 SUSE bug 1174913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-14362 at SUSE CVE-2020-14362 at NVD SUSE bug 1174635 SUSE bug 1174638 SUSE bug 1174910 SUSE bug 1174913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability. Important CVE-2020-14363 at SUSE CVE-2020-14363 at NVD SUSE bug 1175239 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. Moderate CVE-2020-14364 at SUSE CVE-2020-14364 at NVD SUSE bug 1175441 SUSE bug 1175534 SUSE bug 1176494 SUSE bug 1177130 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability. Important CVE-2020-14372 at SUSE CVE-2020-14372 at NVD SUSE bug 1175970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-14385 at SUSE CVE-2020-14385 at NVD SUSE bug 1176137 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. Important CVE-2020-14422 at SUSE CVE-2020-14422 at NVD SUSE bug 1173274 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Important CVE-2020-14556 at SUSE CVE-2020-14556 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-14562 at SUSE CVE-2020-14562 at NVD SUSE bug 1174157 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Important CVE-2020-14573 at SUSE CVE-2020-14573 at NVD SUSE bug 1174157 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Important CVE-2020-14577 at SUSE CVE-2020-14577 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-14578 at SUSE CVE-2020-14578 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-14579 at SUSE CVE-2020-14579 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2020-14583 at SUSE CVE-2020-14583 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N). Important CVE-2020-14593 at SUSE CVE-2020-14593 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Important CVE-2020-14621 at SUSE CVE-2020-14621 at NVD SUSE bug 1174157 SUSE bug 1175259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Critical CVE-2020-1472 at SUSE CVE-2020-1472 at NVD SUSE bug 1176579 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2020-14779 at SUSE CVE-2020-14779 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2020-14781 at SUSE CVE-2020-14781 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2020-14782 at SUSE CVE-2020-14782 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Moderate CVE-2020-14792 at SUSE CVE-2020-14792 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Moderate CVE-2020-14796 at SUSE CVE-2020-14796 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2020-14797 at SUSE CVE-2020-14797 at NVD SUSE bug 1177943 SUSE bug 1180063 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2020-14803 at SUSE CVE-2020-14803 at NVD SUSE bug 1177943 SUSE bug 1181239 SUSE bug 1182186 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value. Important CVE-2020-15049 at SUSE CVE-2020-15049 at NVD SUSE bug 1173455 SUSE bug 1174381 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field. Moderate CVE-2020-15436 at SUSE CVE-2020-15436 at NVD SUSE bug 1179141 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2. Moderate CVE-2020-15648 at SUSE CVE-2020-15648 at NVD SUSE bug 1173948 SUSE bug 1174230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Important CVE-2020-15652 at SUSE CVE-2020-15652 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Important CVE-2020-15653 at SUSE CVE-2020-15653 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Important CVE-2020-15654 at SUSE CVE-2020-15654 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Important CVE-2020-15656 at SUSE CVE-2020-15656 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Important CVE-2020-15658 at SUSE CVE-2020-15658 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Important CVE-2020-15659 at SUSE CVE-2020-15659 at NVD SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. Important CVE-2020-15664 at SUSE CVE-2020-15664 at NVD SUSE bug 1175686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12. Important CVE-2020-15669 at SUSE CVE-2020-15669 at NVD SUSE bug 1175686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Important CVE-2020-15673 at SUSE CVE-2020-15673 at NVD SUSE bug 1176756 SUSE bug 1176899 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Important CVE-2020-15676 at SUSE CVE-2020-15676 at NVD SUSE bug 1176756 SUSE bug 1176899 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Important CVE-2020-15677 at SUSE CVE-2020-15677 at NVD SUSE bug 1176756 SUSE bug 1176899 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Important CVE-2020-15678 at SUSE CVE-2020-15678 at NVD SUSE bug 1176756 SUSE bug 1176899 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. Important CVE-2020-15683 at SUSE CVE-2020-15683 at NVD SUSE bug 1177872 SUSE bug 1177977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7. Important CVE-2020-15685 at SUSE CVE-2020-15685 at NVD SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream. Critical CVE-2020-15810 at SUSE CVE-2020-15810 at NVD SUSE bug 1175664 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches. Critical CVE-2020-15811 at SUSE CVE-2020-15811 at NVD SUSE bug 1175665 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. Important CVE-2020-15862 at SUSE CVE-2020-15862 at NVD SUSE bug 1174961 SUSE bug 1193875 SUSE bug 1196341 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2020-15969 at SUSE CVE-2020-15969 at NVD SUSE bug 1177408 SUSE bug 1177872 SUSE bug 1177977 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2020-15999 at SUSE CVE-2020-15999 at NVD SUSE bug 1177914 SUSE bug 1177936 SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Important CVE-2020-16012 at SUSE CVE-2020-16012 at NVD SUSE bug 1178824 SUSE bug 1178894 SUSE bug 1178923 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Important CVE-2020-16042 at SUSE CVE-2020-16042 at NVD SUSE bug 1179576 SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. Important CVE-2020-16044 at SUSE CVE-2020-16044 at NVD SUSE bug 1180623 SUSE bug 1181137 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c. Moderate CVE-2020-16092 at SUSE CVE-2020-16092 at NVD SUSE bug 1174641 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code. Moderate CVE-2020-1721 at SUSE CVE-2020-1721 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-1722 at SUSE CVE-2020-1722 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Important CVE-2020-1749 at SUSE CVE-2020-1749 at NVD SUSE bug 1165629 SUSE bug 1165631 SUSE bug 1177511 SUSE bug 1177513 SUSE bug 1189302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. Important CVE-2020-17507 at SUSE CVE-2020-17507 at NVD SUSE bug 1176315 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. Moderate CVE-2020-1927 at SUSE CVE-2020-1927 at NVD SUSE bug 1145738 SUSE bug 1168407 SUSE bug 1170718 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. Moderate CVE-2020-1934 at SUSE CVE-2020-1934 at NVD SUSE bug 1168404 SUSE bug 1170718 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. Moderate CVE-2020-1935 at SUSE CVE-2020-1935 at NVD SUSE bug 1164860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. Important CVE-2020-1938 at SUSE CVE-2020-1938 at NVD SUSE bug 1164692 SUSE bug 1166559 SUSE bug 1169066 SUSE bug 1175170 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). Important CVE-2020-1971 at SUSE CVE-2020-1971 at NVD SUSE bug 1179491 SUSE bug 1196179 SUSE bug 1199303 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. Important CVE-2020-1983 at SUSE CVE-2020-1983 at NVD SUSE bug 1170940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory. Important CVE-2020-22218 at SUSE CVE-2020-22218 at NVD SUSE bug 1214527 SUSE bug 1217508 SUSE bug 1218318 SUSE bug 1218349 SUSE bug 1221580 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered. Important CVE-2020-24394 at SUSE CVE-2020-24394 at NVD SUSE bug 1175518 SUSE bug 1175992 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2020-24489 at SUSE CVE-2020-24489 at NVD SUSE bug 1179839 SUSE bug 1192359 SUSE bug 1199300 SUSE bug 1201731 SUSE bug 1225680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-24511 at SUSE CVE-2020-24511 at NVD SUSE bug 1179836 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Low CVE-2020-24512 at SUSE CVE-2020-24512 at NVD SUSE bug 1179837 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-24513 at SUSE CVE-2020-24513 at NVD SUSE bug 1179833 SUSE bug 1192360 SUSE bug 1199300 SUSE bug 1201731 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. Important CVE-2020-24606 at SUSE CVE-2020-24606 at NVD SUSE bug 1175671 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings. Important CVE-2020-25097 at SUSE CVE-2020-25097 at NVD SUSE bug 1183436 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff. Moderate CVE-2020-25211 at SUSE CVE-2020-25211 at NVD SUSE bug 1176395 SUSE bug 1192356 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. Important CVE-2020-25212 at SUSE CVE-2020-25212 at NVD SUSE bug 1176381 SUSE bug 1176382 SUSE bug 1177027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25632 at SUSE CVE-2020-25632 at NVD SUSE bug 1176711 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25637 at SUSE CVE-2020-25637 at NVD SUSE bug 1174955 SUSE bug 1177155 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25643 at SUSE CVE-2020-25643 at NVD SUSE bug 1177206 SUSE bug 1177226 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. Important CVE-2020-25645 at SUSE CVE-2020-25645 at NVD SUSE bug 1177511 SUSE bug 1177513 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25647 at SUSE CVE-2020-25647 at NVD SUSE bug 1177883 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58. Important CVE-2020-25648 at SUSE CVE-2020-25648 at NVD SUSE bug 1177917 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration. Important CVE-2020-25654 at SUSE CVE-2020-25654 at NVD SUSE bug 1173668 SUSE bug 1177916 SUSE bug 1196165 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality. Moderate CVE-2020-25656 at SUSE CVE-2020-25656 at NVD SUSE bug 1177766 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25684 at SUSE CVE-2020-25684 at NVD SUSE bug 1177077 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25685 at SUSE CVE-2020-25685 at NVD SUSE bug 1177077 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity. Important CVE-2020-25686 at SUSE CVE-2020-25686 at NVD SUSE bug 1177077 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service. Important CVE-2020-25692 at SUSE CVE-2020-25692 at NVD SUSE bug 1178387 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Moderate CVE-2020-25694 at SUSE CVE-2020-25694 at NVD SUSE bug 1178667 SUSE bug 1179870 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25695 at SUSE CVE-2020-25695 at NVD SUSE bug 1178666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service. Moderate CVE-2020-25704 at SUSE CVE-2020-25704 at NVD SUSE bug 1178393 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version Important CVE-2020-25705 at SUSE CVE-2020-25705 at NVD SUSE bug 1175721 SUSE bug 1178782 SUSE bug 1178783 SUSE bug 1191790 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP's slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability. Moderate CVE-2020-25709 at SUSE CVE-2020-25709 at NVD SUSE bug 1178909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. Moderate CVE-2020-25710 at SUSE CVE-2020-25710 at NVD SUSE bug 1178909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-25712 at SUSE CVE-2020-25712 at NVD SUSE bug 1174908 SUSE bug 1177596 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity. Moderate CVE-2020-25715 at SUSE CVE-2020-25715 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. Important CVE-2020-25717 at SUSE CVE-2020-25717 at NVD SUSE bug 1192284 SUSE bug 1192505 SUSE bug 1192601 SUSE bug 1192849 SUSE bug 1193011 SUSE bug 1194049 SUSE bug 1194307 SUSE bug 1195815 SUSE bug 1196344 SUSE bug 1196717 SUSE bug 1196920 SUSE bug 1205061 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise. Important CVE-2020-25719 at SUSE CVE-2020-25719 at NVD SUSE bug 1192247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2020-2574 at SUSE CVE-2020-2574 at NVD SUSE bug 1161085 SUSE bug 1162388 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2020-2583 at SUSE CVE-2020-2583 at NVD SUSE bug 1160968 SUSE bug 1162972 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2020-2590 at SUSE CVE-2020-2590 at NVD SUSE bug 1160968 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Moderate CVE-2020-2593 at SUSE CVE-2020-2593 at NVD SUSE bug 1160968 SUSE bug 1162972 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). Moderate CVE-2020-2601 at SUSE CVE-2020-2601 at NVD SUSE bug 1160968 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Important CVE-2020-2604 at SUSE CVE-2020-2604 at NVD SUSE bug 1160968 SUSE bug 1162972 SUSE bug 1165863 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. Moderate CVE-2020-26116 at SUSE CVE-2020-26116 at NVD SUSE bug 1177120 SUSE bug 1177211 SUSE bug 1192361 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. Moderate CVE-2020-26137 at SUSE CVE-2020-26137 at NVD SUSE bug 1177120 SUSE bug 1177211 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14. Important CVE-2020-26217 at SUSE CVE-2020-26217 at NVD SUSE bug 1180994 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2020-2654 at SUSE CVE-2020-2654 at NVD SUSE bug 1160968 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Moderate CVE-2020-2655 at SUSE CVE-2020-2655 at NVD SUSE bug 1160968 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2020-2659 at SUSE CVE-2020-2659 at NVD SUSE bug 1160968 SUSE bug 1162972 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2. Important CVE-2020-26950 at SUSE CVE-2020-26950 at NVD SUSE bug 1177872 SUSE bug 1178588 SUSE bug 1178611 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26951 at SUSE CVE-2020-26951 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26953 at SUSE CVE-2020-26953 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26956 at SUSE CVE-2020-26956 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26958 at SUSE CVE-2020-26958 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26959 at SUSE CVE-2020-26959 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26960 at SUSE CVE-2020-26960 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26961 at SUSE CVE-2020-26961 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26965 at SUSE CVE-2020-26965 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Important CVE-2020-26968 at SUSE CVE-2020-26968 at NVD SUSE bug 1178824 SUSE bug 1178894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1. Critical CVE-2020-26970 at SUSE CVE-2020-26970 at NVD SUSE bug 1179530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-26971 at SUSE CVE-2020-26971 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-26973 at SUSE CVE-2020-26973 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-26974 at SUSE CVE-2020-26974 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. Important CVE-2020-26976 at SUSE CVE-2020-26976 at NVD SUSE bug 1180039 SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-26978 at SUSE CVE-2020-26978 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Moderate CVE-2020-27170 at SUSE CVE-2020-27170 at NVD SUSE bug 1183686 SUSE bug 1183775 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest. Moderate CVE-2020-2732 at SUSE CVE-2020-2732 at NVD SUSE bug 1163971 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2020-2752 at SUSE CVE-2020-2752 at NVD SUSE bug 1171550 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2754 at SUSE CVE-2020-2754 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2755 at SUSE CVE-2020-2755 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2756 at SUSE CVE-2020-2756 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2757 at SUSE CVE-2020-2757 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Important CVE-2020-2767 at SUSE CVE-2020-2767 at NVD SUSE bug 1169511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2773 at SUSE CVE-2020-2773 at NVD SUSE bug 1169511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-27749 at SUSE CVE-2020-27749 at NVD SUSE bug 1179264 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel. Moderate CVE-2020-27777 at SUSE CVE-2020-27777 at NVD SUSE bug 1179107 SUSE bug 1179419 SUSE bug 1200343 SUSE bug 1220060 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2020-27779 at SUSE CVE-2020-27779 at NVD SUSE bug 1179265 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Important CVE-2020-2778 at SUSE CVE-2020-2778 at NVD SUSE bug 1169511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2020-2780 at SUSE CVE-2020-2780 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2781 at SUSE CVE-2020-2781 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Important CVE-2020-2800 at SUSE CVE-2020-2800 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2020-2803 at SUSE CVE-2020-2803 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Important CVE-2020-2805 at SUSE CVE-2020-2805 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2020-2812 at SUSE CVE-2020-2812 at NVD SUSE bug 1171550 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Important CVE-2020-2816 at SUSE CVE-2020-2816 at NVD SUSE bug 1169511 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Important CVE-2020-2830 at SUSE CVE-2020-2830 at NVD SUSE bug 1169511 SUSE bug 1172277 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Important CVE-2020-28374 at SUSE CVE-2020-28374 at NVD SUSE bug 1178372 SUSE bug 1178684 SUSE bug 1180676 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Important CVE-2020-28948 at SUSE CVE-2020-28948 at NVD SUSE bug 1193679 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. Important CVE-2020-28949 at SUSE CVE-2020-28949 at NVD SUSE bug 1193680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. Moderate CVE-2020-29443 at SUSE CVE-2020-29443 at NVD SUSE bug 1181108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference. Important CVE-2020-29573 at SUSE CVE-2020-29573 at NVD SUSE bug 1179721 SUSE bug 1220988 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c. Important CVE-2020-29599 at SUSE CVE-2020-29599 at NVD SUSE bug 1179753 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b. Important CVE-2020-29661 at SUSE CVE-2020-29661 at NVD SUSE bug 1179745 SUSE bug 1179877 SUSE bug 1214268 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-35111 at SUSE CVE-2020-35111 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Important CVE-2020-35113 at SUSE CVE-2020-35113 at NVD SUSE bug 1180039 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow Important CVE-2020-35452 at SUSE CVE-2020-35452 at NVD SUSE bug 1186922 SUSE bug 1187933 SUSE Liberty Linux 7 A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service. Moderate CVE-2020-35513 at SUSE CVE-2020-35513 at NVD SUSE bug 1181362 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. Moderate CVE-2020-35518 at SUSE CVE-2020-35518 at NVD SUSE bug 1181159 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. Important CVE-2020-36193 at SUSE CVE-2020-36193 at NVD SUSE bug 1189591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950. Important CVE-2020-36322 at SUSE CVE-2020-36322 at NVD SUSE bug 1184211 SUSE bug 1184952 SUSE bug 1189302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Critical CVE-2020-36328 at SUSE CVE-2020-36328 at NVD SUSE bug 1185688 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Moderate CVE-2020-36329 at SUSE CVE-2020-36329 at NVD SUSE bug 1185652 SUSE bug 1187486 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c. Important CVE-2020-36385 at SUSE CVE-2020-36385 at NVD SUSE bug 1187050 SUSE bug 1187052 SUSE bug 1189302 SUSE bug 1196174 SUSE bug 1196810 SUSE bug 1196914 SUSE bug 1200084 SUSE bug 1201734 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. Important CVE-2020-36558 at SUSE CVE-2020-36558 at NVD SUSE bug 1200910 SUSE bug 1201752 SUSE bug 1205313 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. A malicious website may be able to cause a denial of service. Important CVE-2020-3862 at SUSE CVE-2020-3862 at NVD SUSE bug 1163809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin. Important CVE-2020-3864 at SUSE CVE-2020-3864 at NVD SUSE bug 1163809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2020-3865 at SUSE CVE-2020-3865 at NVD SUSE bug 1163809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting. Important CVE-2020-3867 at SUSE CVE-2020-3867 at NVD SUSE bug 1163809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2020-3868 at SUSE CVE-2020-3868 at NVD SUSE bug 1163809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A file URL may be incorrectly processed. Important CVE-2020-3885 at SUSE CVE-2020-3885 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory. Important CVE-2020-3894 at SUSE CVE-2020-3894 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2020-3895 at SUSE CVE-2020-3895 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. Important CVE-2020-3897 at SUSE CVE-2020-3897 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. Important CVE-2020-3899 at SUSE CVE-2020-3899 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2020-3900 at SUSE CVE-2020-3900 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution. Important CVE-2020-3901 at SUSE CVE-2020-3901 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack. Important CVE-2020-3902 at SUSE CVE-2020-3902 at NVD SUSE bug 1170643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. Important CVE-2020-5208 at SUSE CVE-2020-5208 at NVD SUSE bug 1163026 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1. Important CVE-2020-5260 at SUSE CVE-2020-5260 at NVD SUSE bug 1168930 SUSE bug 1169936 SUSE bug 1170741 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Important CVE-2020-5312 at SUSE CVE-2020-5312 at NVD SUSE bug 1160152 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Important CVE-2020-5313 at SUSE CVE-2020-5313 at NVD SUSE bug 1160153 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. Moderate CVE-2020-5395 at SUSE CVE-2020-5395 at NVD SUSE bug 1160220 SUSE bug 1178308 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Moderate CVE-2020-6463 at SUSE CVE-2020-6463 at NVD SUSE bug 1171975 SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. Important CVE-2020-6514 at SUSE CVE-2020-6514 at NVD SUSE bug 1174189 SUSE bug 1174538 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5. Important CVE-2020-6792 at SUSE CVE-2020-6792 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5. Important CVE-2020-6793 at SUSE CVE-2020-6793 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5. Important CVE-2020-6794 at SUSE CVE-2020-6794 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects Thunderbird < 68.5. Important CVE-2020-6795 at SUSE CVE-2020-6795 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5. Important CVE-2020-6796 at SUSE CVE-2020-6796 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. Important CVE-2020-6798 at SUSE CVE-2020-6798 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. Important CVE-2020-6800 at SUSE CVE-2020-6800 at NVD SUSE bug 1163368 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6805 at SUSE CVE-2020-6805 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6806 at SUSE CVE-2020-6806 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6807 at SUSE CVE-2020-6807 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6811 at SUSE CVE-2020-6811 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6812 at SUSE CVE-2020-6812 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Important CVE-2020-6814 at SUSE CVE-2020-6814 at NVD SUSE bug 1166238 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Important CVE-2020-6819 at SUSE CVE-2020-6819 at NVD SUSE bug 1168630 SUSE bug 1168874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Important CVE-2020-6820 at SUSE CVE-2020-6820 at NVD SUSE bug 1168630 SUSE bug 1168874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Important CVE-2020-6821 at SUSE CVE-2020-6821 at NVD SUSE bug 1168630 SUSE bug 1168874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Important CVE-2020-6822 at SUSE CVE-2020-6822 at NVD SUSE bug 1168630 SUSE bug 1168874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Important CVE-2020-6825 at SUSE CVE-2020-6825 at NVD SUSE bug 1168630 SUSE bug 1168874 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80. Critical CVE-2020-6829 at SUSE CVE-2020-6829 at NVD SUSE bug 1174763 SUSE bug 1175686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. Important CVE-2020-6831 at SUSE CVE-2020-6831 at NVD SUSE bug 1171186 SUSE bug 1171247 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. Important CVE-2020-6851 at SUSE CVE-2020-6851 at NVD SUSE bug 1160782 SUSE bug 1162090 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. Important CVE-2020-7039 at SUSE CVE-2020-7039 at NVD SUSE bug 1161066 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c. Moderate CVE-2020-7053 at SUSE CVE-2020-7053 at NVD SUSE bug 1160966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. Moderate CVE-2020-7595 at SUSE CVE-2020-7595 at NVD SUSE bug 1161517 SUSE bug 1191860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. Important CVE-2020-8112 at SUSE CVE-2020-8112 at NVD SUSE bug 1162090 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. Important CVE-2020-8177 at SUSE CVE-2020-8177 at NVD SUSE bug 1173027 SUSE bug 1186108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters. Important CVE-2020-8449 at SUSE CVE-2020-8449 at NVD SUSE bug 1162687 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. Important CVE-2020-8450 at SUSE CVE-2020-8450 at NVD SUSE bug 1162687 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. Moderate CVE-2020-8492 at SUSE CVE-2020-8492 at NVD SUSE bug 1162367 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. Important CVE-2020-8597 at SUSE CVE-2020-8597 at NVD SUSE bug 1162610 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. Important CVE-2020-8608 at SUSE CVE-2020-8608 at NVD SUSE bug 1163018 SUSE bug 1163019 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. Important CVE-2020-8616 at SUSE CVE-2020-8616 at NVD SUSE bug 1109160 SUSE bug 1171740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results. Important CVE-2020-8617 at SUSE CVE-2020-8617 at NVD SUSE bug 1109160 SUSE bug 1171740 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit. Important CVE-2020-8622 at SUSE CVE-2020-8622 at NVD SUSE bug 1175443 SUSE bug 1188888 SUSE bug 1191120 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker Important CVE-2020-8623 at SUSE CVE-2020-8623 at NVD SUSE bug 1175443 SUSE bug 1191120 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone. Important CVE-2020-8624 at SUSE CVE-2020-8624 at NVD SUSE bug 1175443 SUSE bug 1191120 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch Important CVE-2020-8625 at SUSE CVE-2020-8625 at NVD SUSE bug 1182246 SUSE bug 1182483 SUSE bug 1192708 SUSE bug 1196172 SUSE bug 1218478 SUSE bug 1225626 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function. Important CVE-2020-8631 at SUSE CVE-2020-8631 at NVD SUSE bug 1162937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords. Important CVE-2020-8632 at SUSE CVE-2020-8632 at NVD SUSE bug 1162936 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. Moderate CVE-2020-8647 at SUSE CVE-2020-8647 at NVD SUSE bug 1162929 SUSE bug 1164078 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. Moderate CVE-2020-8648 at SUSE CVE-2020-8648 at NVD SUSE bug 1162928 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. Moderate CVE-2020-8649 at SUSE CVE-2020-8649 at NVD SUSE bug 1162929 SUSE bug 1162931 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2020-8695 at SUSE CVE-2020-8695 at NVD SUSE bug 1170415 SUSE bug 1170446 SUSE bug 1178591 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-8696 at SUSE CVE-2020-8696 at NVD SUSE bug 1173592 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2020-8698 at SUSE CVE-2020-8698 at NVD SUSE bug 1173594 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS KDE Okular before 1.10.0 allows code execution via an action link in a PDF document. Moderate CVE-2020-9359 at SUSE CVE-2020-9359 at NVD SUSE bug 1167435 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2. Moderate CVE-2020-9383 at SUSE CVE-2020-9383 at NVD SUSE bug 1165111 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. Important CVE-2020-9484 at SUSE CVE-2020-9484 at NVD SUSE bug 1171928 SUSE bug 1182909 SUSE bug 1195255 SUSE bug 1196395 SUSE bug 1201081 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel Important CVE-2021-0920 at SUSE CVE-2021-0920 at NVD SUSE bug 1193731 SUSE bug 1194463 SUSE bug 1195939 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity. Important CVE-2021-20179 at SUSE CVE-2021-20179 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-20225 at SUSE CVE-2021-20225 at NVD SUSE bug 1182262 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-20233 at SUSE CVE-2021-20233 at NVD SUSE bug 1182263 SUSE bug 1183135 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity. Important CVE-2021-20254 at SUSE CVE-2021-20254 at NVD SUSE bug 1184677 SUSE bug 1185886 SUSE bug 1189860 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-20265 at SUSE CVE-2021-20265 at NVD SUSE bug 1183089 SUSE bug 1214268 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability. Low CVE-2021-20271 at SUSE CVE-2021-20271 at NVD SUSE bug 1183545 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability. Important CVE-2021-20277 at SUSE CVE-2021-20277 at NVD SUSE bug 1183574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-20305 at SUSE CVE-2021-20305 at NVD SUSE bug 1183835 SUSE bug 1184401 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. Important CVE-2021-21261 at SUSE CVE-2021-21261 at NVD SUSE bug 1180996 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Important CVE-2021-21344 at SUSE CVE-2021-21344 at NVD SUSE bug 1184375 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Important CVE-2021-21345 at SUSE CVE-2021-21345 at NVD SUSE bug 1184372 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Important CVE-2021-21346 at SUSE CVE-2021-21346 at NVD SUSE bug 1184373 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Important CVE-2021-21347 at SUSE CVE-2021-21347 at NVD SUSE bug 1184378 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Important CVE-2021-21350 at SUSE CVE-2021-21350 at NVD SUSE bug 1184380 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`. Important CVE-2021-21381 at SUSE CVE-2021-21381 at NVD SUSE bug 1183459 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Important CVE-2021-2144 at SUSE CVE-2021-2144 at NVD SUSE Liberty Linux 7 Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Moderate CVE-2021-2163 at SUSE CVE-2021-2163 at NVD SUSE bug 1185055 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Important CVE-2021-22543 at SUSE CVE-2021-22543 at NVD SUSE bug 1186482 SUSE bug 1186483 SUSE bug 1190276 SUSE bug 1197660 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space Important CVE-2021-22555 at SUSE CVE-2021-22555 at NVD SUSE bug 1188116 SUSE bug 1188117 SUSE bug 1188411 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). Moderate CVE-2021-2341 at SUSE CVE-2021-2341 at NVD SUSE bug 1188564 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Moderate CVE-2021-2369 at SUSE CVE-2021-2369 at NVD SUSE bug 1188565 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). Moderate CVE-2021-23840 at SUSE CVE-2021-23840 at NVD SUSE bug 1182333 SUSE bug 1187743 SUSE bug 1214334 SUSE bug 1225628 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). Moderate CVE-2021-23841 at SUSE CVE-2021-23841 at NVD SUSE bug 1182331 SUSE bug 1187743 SUSE bug 1214334 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Important CVE-2021-2388 at SUSE CVE-2021-2388 at NVD SUSE bug 1188566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Important CVE-2021-23953 at SUSE CVE-2021-23953 at NVD SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Important CVE-2021-23954 at SUSE CVE-2021-23954 at NVD SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Important CVE-2021-23960 at SUSE CVE-2021-23960 at NVD SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. Important CVE-2021-23961 at SUSE CVE-2021-23961 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Important CVE-2021-23964 at SUSE CVE-2021-23964 at NVD SUSE bug 1181414 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Important CVE-2021-23968 at SUSE CVE-2021-23968 at NVD SUSE bug 1182614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Important CVE-2021-23969 at SUSE CVE-2021-23969 at NVD SUSE bug 1182614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Important CVE-2021-23973 at SUSE CVE-2021-23973 at NVD SUSE bug 1182614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Important CVE-2021-23978 at SUSE CVE-2021-23978 at NVD SUSE bug 1182614 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. Important CVE-2021-23981 at SUSE CVE-2021-23981 at NVD SUSE bug 1183942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. Important CVE-2021-23982 at SUSE CVE-2021-23982 at NVD SUSE bug 1183942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. Important CVE-2021-23984 at SUSE CVE-2021-23984 at NVD SUSE bug 1183942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. Important CVE-2021-23987 at SUSE CVE-2021-23987 at NVD SUSE bug 1183942 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects Thunderbird < 78.9.1. Moderate CVE-2021-23991 at SUSE CVE-2021-23991 at NVD SUSE bug 1184536 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird < 78.9.1. Moderate CVE-2021-23992 at SUSE CVE-2021-23992 at NVD SUSE bug 1184536 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1. Moderate CVE-2021-23993 at SUSE CVE-2021-23993 at NVD SUSE bug 1184536 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-23994 at SUSE CVE-2021-23994 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-23995 at SUSE CVE-2021-23995 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-23998 at SUSE CVE-2021-23998 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-23999 at SUSE CVE-2021-23999 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-24002 at SUSE CVE-2021-24002 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed. Important CVE-2021-25214 at SUSE CVE-2021-25214 at NVD SUSE bug 1185345 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9. Important CVE-2021-25215 at SUSE CVE-2021-25215 at NVD SUSE bug 1185345 SUSE bug 1189848 SUSE bug 1196172 SUSE bug 1199298 SUSE bug 1225626 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted. Important CVE-2021-25217 at SUSE CVE-2021-25217 at NVD SUSE bug 1186382 SUSE bug 1189843 SUSE bug 1189858 SUSE bug 1199299 SUSE bug 1214270 SUSE bug 1218485 SUSE bug 1218969 SUSE bug 1225674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. Moderate CVE-2021-25220 at SUSE CVE-2021-25220 at NVD SUSE bug 1197135 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. Moderate CVE-2021-26401 at SUSE CVE-2021-26401 at NVD SUSE bug 1191580 SUSE bug 1196901 SUSE bug 1209630 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow Important CVE-2021-26691 at SUSE CVE-2021-26691 at NVD SUSE bug 1187017 SUSE bug 1187933 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence. Important CVE-2021-26937 at SUSE CVE-2021-26937 at NVD SUSE bug 1182092 SUSE bug 1184006 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence. Important CVE-2021-27135 at SUSE CVE-2021-27135 at NVD SUSE bug 1182091 SUSE bug 1189857 SUSE bug 1190262 SUSE bug 1225632 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. Moderate CVE-2021-27219 at SUSE CVE-2021-27219 at NVD SUSE bug 1182362 SUSE bug 1194015 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables. Important CVE-2021-27363 at SUSE CVE-2021-27363 at NVD SUSE bug 1182716 SUSE bug 1182717 SUSE bug 1183120 SUSE bug 1200084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages. Important CVE-2021-27364 at SUSE CVE-2021-27364 at NVD SUSE bug 1182715 SUSE bug 1182716 SUSE bug 1182717 SUSE bug 1200084 SUSE bug 1214268 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. Important CVE-2021-27365 at SUSE CVE-2021-27365 at NVD SUSE bug 1182712 SUSE bug 1182715 SUSE bug 1183491 SUSE bug 1200084 SUSE bug 1214268 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. Important CVE-2021-27803 at SUSE CVE-2021-27803 at NVD SUSE bug 1182805 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. Important CVE-2021-28091 at SUSE CVE-2021-28091 at NVD SUSE bug 1186768 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. Important CVE-2021-29154 at SUSE CVE-2021-29154 at NVD SUSE bug 1184391 SUSE bug 1184710 SUSE bug 1186408 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17. Important CVE-2021-29505 at SUSE CVE-2021-29505 at NVD SUSE bug 1186651 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf. Moderate CVE-2021-29650 at SUSE CVE-2021-29650 at NVD SUSE bug 1184208 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-29945 at SUSE CVE-2021-29945 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Important CVE-2021-29946 at SUSE CVE-2021-29946 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10. Important CVE-2021-29948 at SUSE CVE-2021-29948 at NVD SUSE bug 1184960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2. Low CVE-2021-29956 at SUSE CVE-2021-29956 at NVD SUSE bug 1186199 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2. Low CVE-2021-29957 at SUSE CVE-2021-29957 at NVD SUSE bug 1186198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. Important CVE-2021-29967 at SUSE CVE-2021-29967 at NVD SUSE bug 1186696 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12. Important CVE-2021-29969 at SUSE CVE-2021-29969 at NVD SUSE bug 1188275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. Important CVE-2021-29970 at SUSE CVE-2021-29970 at NVD SUSE bug 1188275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. Important CVE-2021-29976 at SUSE CVE-2021-29976 at NVD SUSE bug 1188275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29980 at SUSE CVE-2021-29980 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29984 at SUSE CVE-2021-29984 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29985 at SUSE CVE-2021-29985 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29986 at SUSE CVE-2021-29986 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29988 at SUSE CVE-2021-29988 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91. Important CVE-2021-29989 at SUSE CVE-2021-29989 at NVD SUSE bug 1188891 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Important CVE-2021-30547 at SUSE CVE-2021-30547 at NVD SUSE bug 1187141 SUSE bug 1188275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Important CVE-2021-30858 at SUSE CVE-2021-30858 at NVD SUSE bug 1190701 SUSE bug 1191298 SUSE bug 1191301 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage Moderate CVE-2021-31291 at SUSE CVE-2021-31291 at NVD SUSE bug 1188733 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session. Important CVE-2021-31535 at SUSE CVE-2021-31535 at NVD SUSE bug 1182506 SUSE bug 1191879 SUSE bug 1205051 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. Important CVE-2021-3156 at SUSE CVE-2021-3156 at NVD SUSE bug 1180684 SUSE bug 1181090 SUSE bug 1181506 SUSE bug 1181657 SUSE bug 1183936 SUSE bug 1218863 SUSE bug 1225623 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. Moderate CVE-2021-3177 at SUSE CVE-2021-3177 at NVD SUSE bug 1181126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-32027 at SUSE CVE-2021-32027 at NVD SUSE bug 1185924 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. Moderate CVE-2021-32142 at SUSE CVE-2021-32142 at NVD SUSE bug 1208470 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller. Important CVE-2021-32399 at SUSE CVE-2021-32399 at NVD SUSE bug 1184611 SUSE bug 1185898 SUSE bug 1185899 SUSE bug 1196174 SUSE bug 1200084 SUSE bug 1201734 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. Critical CVE-2021-3246 at SUSE CVE-2021-3246 at NVD SUSE bug 1188540 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. Critical CVE-2021-32810 at SUSE CVE-2021-32810 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value. Moderate CVE-2021-33033 at SUSE CVE-2021-33033 at NVD SUSE bug 1186109 SUSE bug 1186283 SUSE bug 1188876 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. Important CVE-2021-33034 at SUSE CVE-2021-33034 at NVD SUSE bug 1186111 SUSE bug 1186285 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Important CVE-2021-3347 at SUSE CVE-2021-3347 at NVD SUSE bug 1181349 SUSE bug 1181553 SUSE bug 1190859 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc. Critical CVE-2021-33516 at SUSE CVE-2021-33516 at NVD SUSE bug 1186590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. Important CVE-2021-33909 at SUSE CVE-2021-33909 at NVD SUSE bug 1188062 SUSE bug 1188063 SUSE bug 1188257 SUSE bug 1189302 SUSE bug 1190859 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-3472 at SUSE CVE-2021-3472 at NVD SUSE bug 1180128 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. Important CVE-2021-34798 at SUSE CVE-2021-34798 at NVD SUSE bug 1190669 SUSE bug 1191297 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability. Important CVE-2021-3480 at SUSE CVE-2021-3480 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3504 at SUSE CVE-2021-3504 at NVD SUSE bug 1185013 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2021-35550 at SUSE CVE-2021-35550 at NVD SUSE bug 1191901 SUSE bug 1193314 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35556 at SUSE CVE-2021-35556 at NVD SUSE bug 1191910 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35559 at SUSE CVE-2021-35559 at NVD SUSE bug 1191911 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35561 at SUSE CVE-2021-35561 at NVD SUSE bug 1191912 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2021-35564 at SUSE CVE-2021-35564 at NVD SUSE bug 1191913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35565 at SUSE CVE-2021-35565 at NVD SUSE bug 1191909 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N). Moderate CVE-2021-35567 at SUSE CVE-2021-35567 at NVD SUSE bug 1191903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35578 at SUSE CVE-2021-35578 at NVD SUSE bug 1191904 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2021-35586 at SUSE CVE-2021-35586 at NVD SUSE bug 1191914 SUSE bug 1194928 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u311, 8u301; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). Low CVE-2021-35588 at SUSE CVE-2021-35588 at NVD SUSE bug 1191905 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Low CVE-2021-35603 at SUSE CVE-2021-35603 at NVD SUSE bug 1191906 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13. Moderate CVE-2021-3564 at SUSE CVE-2021-3564 at NVD SUSE bug 1186207 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1. Important CVE-2021-3570 at SUSE CVE-2021-3570 at NVD SUSE bug 1187646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. Important CVE-2021-3573 at SUSE CVE-2021-3573 at NVD SUSE bug 1186666 SUSE bug 1187054 SUSE bug 1188172 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Moderate CVE-2021-3621 at SUSE CVE-2021-3621 at NVD SUSE bug 1189492 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3622 at SUSE CVE-2021-3622 at NVD SUSE bug 1189060 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled. Moderate CVE-2021-3652 at SUSE CVE-2021-3652 at NVD SUSE bug 1188455 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7. Important CVE-2021-3653 at SUSE CVE-2021-3653 at NVD SUSE bug 1189399 SUSE bug 1189420 SUSE bug 1196914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. Important CVE-2021-3656 at SUSE CVE-2021-3656 at NVD SUSE bug 1189400 SUSE bug 1189418 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). Moderate CVE-2021-3712 at SUSE CVE-2021-3712 at NVD SUSE bug 1189521 SUSE bug 1190129 SUSE bug 1191640 SUSE bug 1192100 SUSE bug 1192787 SUSE bug 1194948 SUSE bug 1225628 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-3715 at SUSE CVE-2021-3715 at NVD SUSE bug 1190349 SUSE bug 1190350 SUSE bug 1196722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-3752 at SUSE CVE-2021-3752 at NVD SUSE bug 1190023 SUSE bug 1190432 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. Important CVE-2021-37576 at SUSE CVE-2021-37576 at NVD SUSE bug 1188838 SUSE bug 1188842 SUSE bug 1190276 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Moderate CVE-2021-37750 at SUSE CVE-2021-37750 at NVD SUSE bug 1189929 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14, and Firefox < 92. Important CVE-2021-38493 at SUSE CVE-2021-38493 at NVD SUSE bug 1190269 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. Important CVE-2021-38496 at SUSE CVE-2021-38496 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Important CVE-2021-38497 at SUSE CVE-2021-38497 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Important CVE-2021-38498 at SUSE CVE-2021-38498 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. Important CVE-2021-38500 at SUSE CVE-2021-38500 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Important CVE-2021-38501 at SUSE CVE-2021-38501 at NVD SUSE bug 1191332 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2. Moderate CVE-2021-38502 at SUSE CVE-2021-38502 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38503 at SUSE CVE-2021-38503 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38504 at SUSE CVE-2021-38504 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38506 at SUSE CVE-2021-38506 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38507 at SUSE CVE-2021-38507 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38508 at SUSE CVE-2021-38508 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Important CVE-2021-38509 at SUSE CVE-2021-38509 at NVD SUSE bug 1192250 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39139 at SUSE CVE-2021-39139 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39140 at SUSE CVE-2021-39140 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39141 at SUSE CVE-2021-39141 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39144 at SUSE CVE-2021-39144 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39145 at SUSE CVE-2021-39145 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39146 at SUSE CVE-2021-39146 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39147 at SUSE CVE-2021-39147 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39148 at SUSE CVE-2021-39148 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39149 at SUSE CVE-2021-39149 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18. Important CVE-2021-39150 at SUSE CVE-2021-39150 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39151 at SUSE CVE-2021-39151 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18. Important CVE-2021-39152 at SUSE CVE-2021-39152 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39153 at SUSE CVE-2021-39153 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Important CVE-2021-39154 at SUSE CVE-2021-39154 at NVD SUSE bug 1189798 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier. Important CVE-2021-39275 at SUSE CVE-2021-39275 at NVD SUSE bug 1190666 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-4008 at SUSE CVE-2021-4008 at NVD SUSE bug 1193030 SUSE bug 1194308 SUSE bug 1196656 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-4009 at SUSE CVE-2021-4009 at NVD SUSE bug 1190487 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-4010 at SUSE CVE-2021-4010 at NVD SUSE bug 1190488 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Important CVE-2021-4011 at SUSE CVE-2021-4011 at NVD SUSE bug 1190489 SUSE bug 1196656 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c. Important CVE-2021-40211 at SUSE CVE-2021-40211 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system. Important CVE-2021-4028 at SUSE CVE-2021-4028 at NVD SUSE bug 1193167 SUSE bug 1193529 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. Important CVE-2021-4034 at SUSE CVE-2021-4034 at NVD SUSE bug 1194568 SUSE bug 1195125 SUSE bug 1195136 SUSE bug 1195246 SUSE bug 1195265 SUSE bug 1195278 SUSE bug 1195528 SUSE bug 1195541 SUSE bug 1196165 SUSE bug 1196388 SUSE bug 1225668 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. Important CVE-2021-40438 at SUSE CVE-2021-40438 at NVD SUSE bug 1190703 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4. Important CVE-2021-4083 at SUSE CVE-2021-4083 at NVD SUSE bug 1193727 SUSE bug 1194460 SUSE bug 1196722 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. Moderate CVE-2021-4091 at SUSE CVE-2021-4091 at NVD SUSE bug 1195324 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version. Important CVE-2021-41133 at SUSE CVE-2021-41133 at NVD SUSE bug 1191507 SUSE bug 1191937 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway. Important CVE-2021-41159 at SUSE CVE-2021-41159 at NVD SUSE bug 1191895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1. Important CVE-2021-41160 at SUSE CVE-2021-41160 at NVD SUSE bug 1191895 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2021-4140 at SUSE CVE-2021-4140 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Moderate CVE-2021-4155 at SUSE CVE-2021-4155 at NVD SUSE bug 1194272 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Important CVE-2021-41617 at SUSE CVE-2021-41617 at NVD SUSE bug 1190975 SUSE bug 1193497 SUSE bug 1196721 SUSE bug 1200782 SUSE bug 1205056 SUSE bug 1212247 SUSE bug 1212281 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover). Moderate CVE-2021-42097 at SUSE CVE-2021-42097 at NVD SUSE bug 1191960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm. Important CVE-2021-42574 at SUSE CVE-2021-42574 at NVD SUSE bug 1191820 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking. Important CVE-2021-42739 at SUSE CVE-2021-42739 at NVD SUSE bug 1184673 SUSE bug 1192036 SUSE bug 1196722 SUSE bug 1196914 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1. Important CVE-2021-43527 at SUSE CVE-2021-43527 at NVD SUSE bug 1193170 SUSE bug 1193331 SUSE bug 1193378 SUSE bug 1194288 SUSE bug 1199301 SUSE bug 1225630 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0. Important CVE-2021-43528 at SUSE CVE-2021-43528 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43536 at SUSE CVE-2021-43536 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43537 at SUSE CVE-2021-43537 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43538 at SUSE CVE-2021-43538 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43539 at SUSE CVE-2021-43539 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43541 at SUSE CVE-2021-43541 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43542 at SUSE CVE-2021-43542 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43543 at SUSE CVE-2021-43543 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43545 at SUSE CVE-2021-43545 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Important CVE-2021-43546 at SUSE CVE-2021-43546 at NVD SUSE bug 1193485 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. Critical CVE-2021-44142 at SUSE CVE-2021-44142 at NVD SUSE bug 1194859 SUSE bug 1195611 SUSE bug 1196455 SUSE bug 1199646 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes. Important CVE-2021-44227 at SUSE CVE-2021-44227 at NVD SUSE bug 1193316 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. Critical CVE-2021-44790 at SUSE CVE-2021-44790 at NVD SUSE bug 1193942 SUSE bug 1204730 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. Important CVE-2021-45417 at SUSE CVE-2021-45417 at NVD SUSE bug 1194735 SUSE bug 1196390 SUSE bug 1225074 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature. Important CVE-2021-45463 at SUSE CVE-2021-45463 at NVD SUSE bug 1194045 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Moderate CVE-2021-45960 at SUSE CVE-2021-45960 at NVD SUSE bug 1194251 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Important CVE-2021-46143 at SUSE CVE-2021-46143 at NVD SUSE bug 1194362 SUSE bug 1195327 SUSE bug 1196387 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. Important CVE-2021-46784 at SUSE CVE-2021-46784 at NVD SUSE bug 1200907 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Important CVE-2022-0330 at SUSE CVE-2022-0330 at NVD SUSE bug 1194880 SUSE bug 1195950 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. Important CVE-2022-0492 at SUSE CVE-2022-0492 at NVD SUSE bug 1195543 SUSE bug 1195908 SUSE bug 1196612 SUSE bug 1196776 SUSE bug 1198615 SUSE bug 1199255 SUSE bug 1199615 SUSE bug 1200084 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1. Important CVE-2022-0566 at SUSE CVE-2022-0566 at NVD SUSE bug 1196072 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). Important CVE-2022-0778 at SUSE CVE-2022-0778 at NVD SUSE bug 1196877 SUSE bug 1197328 SUSE bug 1197340 SUSE bug 1199100 SUSE bug 1199254 SUSE bug 1199303 SUSE bug 1199339 SUSE bug 1200090 SUSE bug 1225670 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing. Important CVE-2022-0918 at SUSE CVE-2022-0918 at NVD SUSE bug 1197275 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. Moderate CVE-2022-0996 at SUSE CVE-2022-0996 at NVD SUSE bug 1197345 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. Important CVE-2022-1011 at SUSE CVE-2022-1011 at NVD SUSE bug 1197343 SUSE bug 1197344 SUSE bug 1198687 SUSE bug 1204132 SUSE bug 1212322 SUSE Liberty Linux 7 <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-1097 at SUSE CVE-2022-1097 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8. Important CVE-2022-1196 at SUSE CVE-2022-1196 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8. Important CVE-2022-1197 at SUSE CVE-2022-1197 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system. Important CVE-2022-1271 at SUSE CVE-2022-1271 at NVD SUSE bug 1198062 SUSE bug 1198812 SUSE bug 1199107 SUSE bug 1199108 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9. Important CVE-2022-1520 at SUSE CVE-2022-1520 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Important CVE-2022-1529 at SUSE CVE-2022-1529 at NVD SUSE bug 1199768 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity. Important CVE-2022-1552 at SUSE CVE-2022-1552 at NVD SUSE bug 1199475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. Important CVE-2022-1729 at SUSE CVE-2022-1729 at NVD SUSE bug 1199507 SUSE bug 1199697 SUSE bug 1201832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Important CVE-2022-1802 at SUSE CVE-2022-1802 at NVD SUSE bug 1199768 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10. Important CVE-2022-1834 at SUSE CVE-2022-1834 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2022-1966 at SUSE CVE-2022-1966 at NVD SUSE bug 1200015 SUSE bug 1200268 SUSE bug 1200494 SUSE bug 1200529 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21123 at SUSE CVE-2022-21123 at NVD SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209075 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21125 at SUSE CVE-2022-21125 at NVD SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209074 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21166 at SUSE CVE-2022-21166 at NVD SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209073 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21248 at SUSE CVE-2022-21248 at NVD SUSE bug 1194926 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21277 at SUSE CVE-2022-21277 at NVD SUSE bug 1194930 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2022-21282 at SUSE CVE-2022-21282 at NVD SUSE bug 1194933 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21283 at SUSE CVE-2022-21283 at NVD SUSE bug 1194937 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21291 at SUSE CVE-2022-21291 at NVD SUSE bug 1194925 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21293 at SUSE CVE-2022-21293 at NVD SUSE bug 1194935 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21294 at SUSE CVE-2022-21294 at NVD SUSE bug 1194934 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2022-21296 at SUSE CVE-2022-21296 at NVD SUSE bug 1194932 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21299 at SUSE CVE-2022-21299 at NVD SUSE bug 1194931 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21305 at SUSE CVE-2022-21305 at NVD SUSE bug 1194939 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK. Important CVE-2022-2132 at SUSE CVE-2022-2132 at NVD SUSE bug 1202903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21340 at SUSE CVE-2022-21340 at NVD SUSE bug 1194940 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21341 at SUSE CVE-2022-21341 at NVD SUSE bug 1194941 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21360 at SUSE CVE-2022-21360 at NVD SUSE bug 1194929 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21365 at SUSE CVE-2022-21365 at NVD SUSE bug 1194928 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21366 at SUSE CVE-2022-21366 at NVD SUSE bug 1194927 SUSE bug 1197126 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21426 at SUSE CVE-2022-21426 at NVD SUSE bug 1198672 SUSE bug 1201643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21434 at SUSE CVE-2022-21434 at NVD SUSE bug 1198674 SUSE bug 1201643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Low CVE-2022-21443 at SUSE CVE-2022-21443 at NVD SUSE bug 1198675 SUSE bug 1201643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Important CVE-2022-21476 at SUSE CVE-2022-21476 at NVD SUSE bug 1198671 SUSE bug 1201643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21496 at SUSE CVE-2022-21496 at NVD SUSE bug 1198673 SUSE bug 1201643 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Moderate CVE-2022-21540 at SUSE CVE-2022-21540 at NVD SUSE bug 1201694 SUSE bug 1202427 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Moderate CVE-2022-21541 at SUSE CVE-2022-21541 at NVD SUSE bug 1201692 SUSE bug 1202427 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2022-21618 at SUSE CVE-2022-21618 at NVD SUSE bug 1204468 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2022-21619 at SUSE CVE-2022-21619 at NVD SUSE bug 1204473 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2022-21624 at SUSE CVE-2022-21624 at NVD SUSE bug 1204475 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21626 at SUSE CVE-2022-21626 at NVD SUSE bug 1204471 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Moderate CVE-2022-21628 at SUSE CVE-2022-21628 at NVD SUSE bug 1204472 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Important CVE-2022-2200 at SUSE CVE-2022-2200 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11. Moderate CVE-2022-2226 at SUSE CVE-2022-2226 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling Important CVE-2022-22720 at SUSE CVE-2022-22720 at NVD SUSE bug 1197095 SUSE bug 1198430 SUSE bug 1198998 SUSE bug 1199102 SUSE bug 1199495 SUSE bug 1204730 SUSE bug 1225670 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22737 at SUSE CVE-2022-22737 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22738 at SUSE CVE-2022-22738 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22739 at SUSE CVE-2022-22739 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22740 at SUSE CVE-2022-22740 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22741 at SUSE CVE-2022-22741 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22742 at SUSE CVE-2022-22742 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22743 at SUSE CVE-2022-22743 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22745 at SUSE CVE-2022-22745 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22747 at SUSE CVE-2022-22747 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22748 at SUSE CVE-2022-22748 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Moderate CVE-2022-22751 at SUSE CVE-2022-22751 at NVD SUSE bug 1194547 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22754 at SUSE CVE-2022-22754 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22756 at SUSE CVE-2022-22756 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22759 at SUSE CVE-2022-22759 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22760 at SUSE CVE-2022-22760 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22761 at SUSE CVE-2022-22761 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22763 at SUSE CVE-2022-22763 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Critical CVE-2022-22764 at SUSE CVE-2022-22764 at NVD SUSE bug 1195682 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. Low CVE-2022-22816 at SUSE CVE-2022-22816 at NVD SUSE bug 1194551 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. Moderate CVE-2022-22817 at SUSE CVE-2022-22817 at NVD SUSE bug 1194521 SUSE bug 1219048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22822 at SUSE CVE-2022-22822 at NVD SUSE bug 1194474 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22823 at SUSE CVE-2022-22823 at NVD SUSE bug 1194476 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22824 at SUSE CVE-2022-22824 at NVD SUSE bug 1194477 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22825 at SUSE CVE-2022-22825 at NVD SUSE bug 1194478 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22826 at SUSE CVE-2022-22826 at NVD SUSE bug 1194479 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Important CVE-2022-22827 at SUSE CVE-2022-22827 at NVD SUSE bug 1194480 SUSE bug 1195327 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer. Important CVE-2022-22942 at SUSE CVE-2022-22942 at NVD SUSE bug 1195065 SUSE bug 1195951 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length. Important CVE-2022-2319 at SUSE CVE-2022-2319 at NVD SUSE bug 1194179 SUSE bug 1204093 SUSE bug 1205071 SUSE bug 1206243 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root. Important CVE-2022-2320 at SUSE CVE-2022-2320 at NVD SUSE bug 1194181 SUSE bug 1201793 SUSE bug 1204123 SUSE bug 1205071 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. Important CVE-2022-23521 at SUSE CVE-2022-23521 at NVD SUSE bug 1207032 SUSE bug 1207033 SUSE bug 1208650 SUSE bug 1209317 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none. Moderate CVE-2022-23816 at SUSE CVE-2022-23816 at NVD SUSE bug 1201456 SUSE bug 1201469 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. Moderate CVE-2022-23825 at SUSE CVE-2022-23825 at NVD SUSE bug 1201457 SUSE bug 1201469 SUSE bug 1205209 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. Important CVE-2022-23852 at SUSE CVE-2022-23852 at NVD SUSE bug 1195054 SUSE bug 1196480 SUSE bug 1200038 SUSE bug 1200198 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content. Important CVE-2022-2393 at SUSE CVE-2022-2393 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. Important CVE-2022-2414 at SUSE CVE-2022-2414 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. Important CVE-2022-24407 at SUSE CVE-2022-24407 at NVD SUSE bug 1196036 SUSE bug 1198600 SUSE bug 1199112 SUSE bug 1199494 SUSE bug 1200197 SUSE bug 1200200 SUSE bug 1225034 SUSE bug 1225669 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes. Moderate CVE-2022-24713 at SUSE CVE-2022-24713 at NVD SUSE bug 1196972 SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy. Moderate CVE-2022-24801 at SUSE CVE-2022-24801 at NVD SUSE bug 1198086 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability. Important CVE-2022-24903 at SUSE CVE-2022-24903 at NVD SUSE bug 1199061 SUSE bug 1201736 SUSE bug 1206201 SUSE bug 1225528 SUSE bug 1225631 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.1, Firefox < 103, and Thunderbird < 102.1. Important CVE-2022-2505 at SUSE CVE-2022-2505 at NVD SUSE bug 1201758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. Critical CVE-2022-25147 at SUSE CVE-2022-25147 at NVD SUSE bug 1207866 SUSE bug 1209320 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Important CVE-2022-25235 at SUSE CVE-2022-25235 at NVD SUSE bug 1196026 SUSE bug 1197217 SUSE bug 1198587 SUSE bug 1200038 SUSE bug 1200198 SUSE bug 1201735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Important CVE-2022-25236 at SUSE CVE-2022-25236 at NVD SUSE bug 1196025 SUSE bug 1196784 SUSE bug 1197217 SUSE bug 1200038 SUSE bug 1201735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later. Important CVE-2022-2526 at SUSE CVE-2022-2526 at NVD SUSE bug 1202574 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Important CVE-2022-25315 at SUSE CVE-2022-25315 at NVD SUSE bug 1196171 SUSE bug 1197217 SUSE bug 1198587 SUSE bug 1200038 SUSE bug 1200198 SUSE bug 1201735 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0. Important CVE-2022-2588 at SUSE CVE-2022-2588 at NVD SUSE bug 1202096 SUSE bug 1203613 SUSE bug 1204183 SUSE bug 1209225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. Moderate CVE-2022-2601 at SUSE CVE-2022-2601 at NVD SUSE bug 1205178 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Moderate CVE-2022-26373 at SUSE CVE-2022-26373 at NVD SUSE bug 1201726 SUSE bug 1209619 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. Critical CVE-2022-26381 at SUSE CVE-2022-26381 at NVD SUSE bug 1196900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. Critical CVE-2022-26383 at SUSE CVE-2022-26383 at NVD SUSE bug 1196900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. Critical CVE-2022-26384 at SUSE CVE-2022-26384 at NVD SUSE bug 1196900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. Critical CVE-2022-26386 at SUSE CVE-2022-26386 at NVD SUSE bug 1196900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. Critical CVE-2022-26387 at SUSE CVE-2022-26387 at NVD SUSE bug 1196900 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. Important CVE-2022-26485 at SUSE CVE-2022-26485 at NVD SUSE bug 1196809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. Important CVE-2022-26486 at SUSE CVE-2022-26486 at NVD SUSE bug 1196809 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-27635 at SUSE CVE-2022-27635 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. Moderate CVE-2022-2795 at SUSE CVE-2022-2795 at NVD SUSE bug 1203614 SUSE bug 1205842 SUSE bug 1209913 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-28281 at SUSE CVE-2022-28281 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-28282 at SUSE CVE-2022-28282 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-28285 at SUSE CVE-2022-28285 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-28286 at SUSE CVE-2022-28286 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Important CVE-2022-28289 at SUSE CVE-2022-28289 at NVD SUSE bug 1197903 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514. Moderate CVE-2022-2850 at SUSE CVE-2022-2850 at NVD SUSE bug 1202470 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer. Important CVE-2022-28733 at SUSE CVE-2022-28733 at NVD SUSE bug 1198460 SUSE bug 1203445 SUSE bug 1205057 SUSE bug 1227915 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). Important CVE-2022-29154 at SUSE CVE-2022-29154 at NVD SUSE bug 1201840 SUSE bug 1202970 SUSE bug 1202998 SUSE bug 1203401 SUSE bug 1203727 SUSE bug 1203789 SUSE bug 1204119 SUSE bug 1205072 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Important CVE-2022-2964 at SUSE CVE-2022-2964 at NVD SUSE bug 1202686 SUSE bug 1203008 SUSE bug 1208044 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29900 at SUSE CVE-2022-29900 at NVD SUSE bug 1199657 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29901 at SUSE CVE-2022-29901 at NVD SUSE bug 1199657 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29909 at SUSE CVE-2022-29909 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29911 at SUSE CVE-2022-29911 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29912 at SUSE CVE-2022-29912 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9. Important CVE-2022-29913 at SUSE CVE-2022-29913 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29914 at SUSE CVE-2022-29914 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29916 at SUSE CVE-2022-29916 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Important CVE-2022-29917 at SUSE CVE-2022-29917 at NVD SUSE bug 1198970 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack. Critical CVE-2022-30123 at SUSE CVE-2022-30123 at NVD SUSE bug 1200750 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. Important CVE-2022-3032 at SUSE CVE-2022-3032 at NVD SUSE bug 1203007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. Important CVE-2022-3033 at SUSE CVE-2022-3033 at NVD SUSE bug 1203007 SUSE bug 1205941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1. Important CVE-2022-3034 at SUSE CVE-2022-3034 at NVD SUSE bug 1203007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. Important CVE-2022-31676 at SUSE CVE-2022-31676 at NVD SUSE bug 1202657 SUSE bug 1202733 SUSE bug 1202834 SUSE bug 1202995 SUSE bug 1204044 SUSE bug 1205471 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31736 at SUSE CVE-2022-31736 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31737 at SUSE CVE-2022-31737 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31738 at SUSE CVE-2022-31738 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31740 at SUSE CVE-2022-31740 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31741 at SUSE CVE-2022-31741 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31742 at SUSE CVE-2022-31742 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. Important CVE-2022-31744 at SUSE CVE-2022-31744 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31747 at SUSE CVE-2022-31747 at NVD SUSE bug 1200027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan. Important CVE-2022-34169 at SUSE CVE-2022-34169 at NVD SUSE bug 1201684 SUSE bug 1202427 SUSE bug 1207688 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34468 at SUSE CVE-2022-34468 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34470 at SUSE CVE-2022-34470 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34472 at SUSE CVE-2022-34472 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34479 at SUSE CVE-2022-34479 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34481 at SUSE CVE-2022-34481 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Moderate CVE-2022-34484 at SUSE CVE-2022-34484 at NVD SUSE bug 1200793 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. Critical CVE-2022-3515 at SUSE CVE-2022-3515 at NVD SUSE bug 1204357 SUSE bug 1204806 SUSE bug 1205080 SUSE bug 1205592 SUSE bug 1205627 SUSE bug 1206244 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051. Important CVE-2022-3550 at SUSE CVE-2022-3550 at NVD SUSE bug 1204412 SUSE bug 1204808 SUSE bug 1205071 SUSE bug 1206243 SUSE bug 1208344 SUSE bug 1209331 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052. Moderate CVE-2022-3551 at SUSE CVE-2022-3551 at NVD SUSE bug 1204416 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. Important CVE-2022-3560 at SUSE CVE-2022-3560 at NVD SUSE bug 1202933 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. Important CVE-2022-3564 at SUSE CVE-2022-3564 at NVD SUSE bug 1206073 SUSE bug 1206314 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This issue has been fixed in matrix-js-sdk 19.4.0 and users are advised to upgrade. Users unable to upgrade may mitigate this issue by redacting applicable events, waiting for the sync processor to store data, and restarting the client. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues. In some cases, no workarounds are possible. Important CVE-2022-36059 at SUSE CVE-2022-36059 at NVD SUSE bug 1203007 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. Important CVE-2022-36318 at SUSE CVE-2022-36318 at NVD SUSE bug 1201758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. Important CVE-2022-36319 at SUSE CVE-2022-36319 at NVD SUSE bug 1201758 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access. Moderate CVE-2022-36351 at SUSE CVE-2022-36351 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944. Important CVE-2022-3640 at SUSE CVE-2022-3640 at NVD SUSE bug 1204619 SUSE bug 1204624 SUSE bug 1209225 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). Important CVE-2022-37434 at SUSE CVE-2022-37434 at NVD SUSE bug 1202175 SUSE bug 1203030 SUSE bug 1205074 SUSE bug 1205289 SUSE bug 1216542 SUSE bug 1225671 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Important CVE-2022-38023 at SUSE CVE-2022-38023 at NVD SUSE bug 1206504 SUSE bug 1209664 SUSE bug 1213694 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access. Low CVE-2022-38076 at SUSE CVE-2022-38076 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. Important CVE-2022-38177 at SUSE CVE-2022-38177 at NVD SUSE bug 1203619 SUSE bug 1204101 SUSE bug 1205078 SUSE bug 1205219 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. Important CVE-2022-38178 at SUSE CVE-2022-38178 at NVD SUSE bug 1203620 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Important CVE-2022-38472 at SUSE CVE-2022-38472 at NVD SUSE bug 1202645 SUSE bug 1205832 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Important CVE-2022-38473 at SUSE CVE-2022-38473 at NVD SUSE bug 1202645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2. Important CVE-2022-38476 at SUSE CVE-2022-38476 at NVD SUSE bug 1202645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. Important CVE-2022-38477 at SUSE CVE-2022-38477 at NVD SUSE bug 1202645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Important CVE-2022-38478 at SUSE CVE-2022-38478 at NVD SUSE bug 1202645 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue. Important CVE-2022-39236 at SUSE CVE-2022-39236 at NVD SUSE bug 1204411 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround. Important CVE-2022-39249 at SUSE CVE-2022-39249 at NVD SUSE bug 1204411 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users' identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround. Important CVE-2022-39250 at SUSE CVE-2022-39250 at NVD SUSE bug 1204411 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. Important CVE-2022-39251 at SUSE CVE-2022-39251 at NVD SUSE bug 1204411 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2022-39399 at SUSE CVE-2022-39399 at NVD SUSE bug 1204480 SUSE bug 1205302 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Important CVE-2022-40674 at SUSE CVE-2022-40674 at NVD SUSE bug 1203438 SUSE bug 1204099 SUSE bug 1204177 SUSE bug 1204509 SUSE bug 1205077 SUSE bug 1205285 SUSE bug 1205527 SUSE bug 1205598 SUSE bug 1208339 SUSE bug 1208753 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40956 at SUSE CVE-2022-40956 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40957 at SUSE CVE-2022-40957 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40958 at SUSE CVE-2022-40958 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40959 at SUSE CVE-2022-40959 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40960 at SUSE CVE-2022-40960 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Important CVE-2022-40962 at SUSE CVE-2022-40962 at NVD SUSE bug 1203477 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-40964 at SUSE CVE-2022-40964 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-40982 at SUSE CVE-2022-40982 at NVD SUSE bug 1206418 SUSE bug 1215674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7. Important CVE-2022-41318 at SUSE CVE-2022-41318 at NVD SUSE bug 1203680 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled. Important CVE-2022-41853 at SUSE CVE-2022-41853 at NVD SUSE bug 1204521 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. Important CVE-2022-41903 at SUSE CVE-2022-41903 at NVD SUSE bug 1207032 SUSE bug 1207033 SUSE bug 1208650 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR. Important CVE-2022-41974 at SUSE CVE-2022-41974 at NVD SUSE bug 1205472 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters Important CVE-2022-4254 at SUSE CVE-2022-4254 at NVD SUSE bug 1207474 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. Important CVE-2022-42703 at SUSE CVE-2022-42703 at NVD SUSE bug 1202096 SUSE bug 1204168 SUSE bug 1204170 SUSE bug 1206463 SUSE bug 1208044 SUSE bug 1209225 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Important CVE-2022-4283 at SUSE CVE-2022-4283 at NVD SUSE bug 1206017 SUSE bug 1208344 SUSE bug 1208653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url Moderate CVE-2022-42896 at SUSE CVE-2022-42896 at NVD SUSE bug 1205709 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug." Moderate CVE-2022-42898 at SUSE CVE-2022-42898 at NVD SUSE bug 1205126 SUSE bug 1205667 SUSE bug 1207423 SUSE bug 1207690 SUSE bug 1211487 SUSE bug 1225675 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0. Important CVE-2022-42920 at SUSE CVE-2022-42920 at NVD SUSE bug 1205125 SUSE bug 1209316 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Important CVE-2022-42927 at SUSE CVE-2022-42927 at NVD SUSE bug 1204421 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Important CVE-2022-42928 at SUSE CVE-2022-42928 at NVD SUSE bug 1204421 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Important CVE-2022-42929 at SUSE CVE-2022-42929 at NVD SUSE bug 1204421 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Important CVE-2022-42932 at SUSE CVE-2022-42932 at NVD SUSE bug 1204421 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. Moderate CVE-2022-43552 at SUSE CVE-2022-43552 at NVD SUSE bug 1206309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. Moderate CVE-2022-43750 at SUSE CVE-2022-43750 at NVD SUSE bug 1204653 SUSE bug 1211484 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4378 at SUSE CVE-2022-4378 at NVD SUSE bug 1206207 SUSE bug 1206228 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1209225 SUSE bug 1211118 SUSE bug 1214268 SUSE bug 1218483 SUSE bug 1218966 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45403 at SUSE CVE-2022-45403 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45404 at SUSE CVE-2022-45404 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45405 at SUSE CVE-2022-45405 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45406 at SUSE CVE-2022-45406 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45408 at SUSE CVE-2022-45408 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45409 at SUSE CVE-2022-45409 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45410 at SUSE CVE-2022-45410 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45411 at SUSE CVE-2022-45411 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45412 at SUSE CVE-2022-45412 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1. Moderate CVE-2022-45414 at SUSE CVE-2022-45414 at NVD SUSE bug 1205941 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45416 at SUSE CVE-2022-45416 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45418 at SUSE CVE-2022-45418 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45420 at SUSE CVE-2022-45420 at NVD SUSE bug 1205270 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Critical CVE-2022-45421 at SUSE CVE-2022-45421 at NVD SUSE bug 1205270 SUSE bug 1206343 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-46329 at SUSE CVE-2022-46329 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order. Important CVE-2022-46340 at SUSE CVE-2022-46340 at NVD SUSE bug 1205874 SUSE bug 1206822 SUSE bug 1208344 SUSE bug 1208653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Important CVE-2022-46341 at SUSE CVE-2022-46341 at NVD SUSE bug 1205877 SUSE bug 1208653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se Moderate CVE-2022-46342 at SUSE CVE-2022-46342 at NVD SUSE bug 1205879 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Moderate CVE-2022-46343 at SUSE CVE-2022-46343 at NVD SUSE bug 1205878 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Moderate CVE-2022-46344 at SUSE CVE-2022-46344 at NVD SUSE bug 1205876 SUSE bug 1217766 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. Important CVE-2022-46871 at SUSE CVE-2022-46871 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. Important CVE-2022-46872 at SUSE CVE-2022-46872 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6. Important CVE-2022-46874 at SUSE CVE-2022-46874 at NVD SUSE bug 1206242 SUSE bug 1206653 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108. Important CVE-2022-46877 at SUSE CVE-2022-46877 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. Important CVE-2022-46878 at SUSE CVE-2022-46878 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6. Important CVE-2022-46880 at SUSE CVE-2022-46880 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6. Important CVE-2022-46881 at SUSE CVE-2022-46881 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6. Important CVE-2022-46882 at SUSE CVE-2022-46882 at NVD SUSE bug 1206242 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Important CVE-2022-47629 at SUSE CVE-2022-47629 at NVD SUSE bug 1206579 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed. Important CVE-2022-48339 at SUSE CVE-2022-48339 at NVD SUSE bug 1208512 SUSE bug 1211512 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Low CVE-2022-48701 at SUSE CVE-2022-48701 at NVD SUSE bug 1223921 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. Important CVE-2022-4883 at SUSE CVE-2022-4883 at NVD SUSE bug 1207031 SUSE bug 1208055 SUSE bug 1208351 SUSE bug 1208654 SUSE bug 1209322 SUSE bug 1209940 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: HID: core: fix shift-out-of-bounds in hid_report_raw_event Syzbot reported shift-out-of-bounds in hid_report_raw_event. microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) > 32! (swapper/0) ====================================================================== UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20 shift exponent 127 is too large for 32-bit type 'int' CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322 snto32 drivers/hid/hid-core.c:1323 [inline] hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline] hid_process_report drivers/hid/hid-core.c:1665 [inline] hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998 hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066 hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284 __usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671 dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988 call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x76a/0x980 kernel/time/timer.c:1790 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803 __do_softirq+0x277/0x75b kernel/softirq.c:571 __irq_exit_rcu+0xec/0x170 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107 ====================================================================== If the size of the integer (unsigned n) is bigger than 32 in snto32(), shift exponent will be too large for 32-bit type 'int', resulting in a shift-out-of-bounds bug. Fix this by adding a check on the size of the integer (unsigned n) in snto32(). To add support for n greater than 32 bits, set n to 32, if n is greater than 32. Moderate CVE-2022-48978 at SUSE CVE-2022-48978 at NVD SUSE bug 1232038 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() `struct vmci_event_qp` allocated by qp_notify_peer() contains padding, which may carry uninitialized data to the userspace, as observed by KMSAN: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121 instrument_copy_to_user ./include/linux/instrumented.h:121 _copy_to_user+0x5f/0xb0 lib/usercopy.c:33 copy_to_user ./include/linux/uaccess.h:169 vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431 vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925 vfs_ioctl fs/ioctl.c:51 ... Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271 vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339 qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479 qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662 qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750 vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940 vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488 vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927 ... Local variable ev created at: qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456 qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662 qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750 Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100 Use memset() to prevent the infoleaks. Also speculatively fix qp_notify_peer_local(), which may suffer from the same problem. Moderate CVE-2022-49788 at SUSE CVE-2022-49788 at NVD SUSE bug 1242353 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock. Moderate CVE-2022-50020 at SUSE CVE-2022-50020 at NVD SUSE bug 1245129 SUSE bug 1245130 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function. Moderate CVE-2022-50022 at SUSE CVE-2022-50022 at NVD SUSE bug 1245131 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aq_vec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue: events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] <TASK> [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [ 97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [ 97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] </TASK> v2. fixed "warning: variable 'aq_vec' set but not used" v3. simplified a for loop Moderate CVE-2022-50066 at SUSE CVE-2022-50066 at NVD SUSE bug 1244985 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 ---truncated--- Moderate CVE-2022-50211 at SUSE CVE-2022-50211 at NVD SUSE bug 1245140 SUSE bug 1245141 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Moderate CVE-2022-50229 at SUSE CVE-2022-50229 at NVD SUSE bug 1244856 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses. Moderate CVE-2022-50341 at SUSE CVE-2022-50341 at NVD SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked to clear resources. In this case, the q->qdisc is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() sfb_init() tcf_block_get() --->failed, q->qdisc is NULL ... qdisc_put() ... sfb_reset() qdisc_reset(q->qdisc) --->q->qdisc is NULL ops = qdisc->ops The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:qdisc_reset+0x2b/0x6f0 Call Trace: <TASK> sfb_reset+0x37/0xd0 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f2164122d04 </TASK> Moderate CVE-2022-50356 at SUSE CVE-2022-50356 at NVD SUSE bug 1250040 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes) Important CVE-2022-50367 at SUSE CVE-2022-50367 at NVD SUSE bug 1247374 SUSE bug 1250277 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 Important CVE-2022-50386 at SUSE CVE-2022-50386 at NVD SUSE bug 1247374 SUSE bug 1250301 SUSE bug 1250302 SUSE Liberty Linux 7 LTSS This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Moderate CVE-2022-50403 at SUSE CVE-2022-50403 at NVD SUSE bug 1250143 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer: Buffer I/O error on dev dm-0, logical block 8733689, async page read (ftrace buffer empty) XFS (dm-0): log I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS (dm-0): Please unmount the filesystem and rectify the problem(s) XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT potentially unexpected fatal signal 6. nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT nf_reject_ipv4 CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868 x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace: errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: ---truncated--- Moderate CVE-2022-50406 at SUSE CVE-2022-50406 at NVD SUSE bug 1250165 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[REDACTED] #1 [ 46.947255] Hardware name: [REDACTED] [ 46.954568] Call trace: [ 46.957037] dump_backtrace+0x0/0x2b8 [ 46.960719] show_stack+0x24/0x30 [ 46.964052] dump_stack+0x128/0x194 [ 46.967557] print_address_description.isra.0+0x64/0x380 [ 46.972877] __kasan_report+0x1d4/0x240 [ 46.976723] kasan_report+0xc/0x18 [ 46.980138] __asan_report_load4_noabort+0x18/0x20 [ 46.985027] brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.990613] dev_hard_start_xmit+0x1bc/0xda0 [ 46.994894] sch_direct_xmit+0x198/0xd08 [ 46.998827] __qdisc_run+0x37c/0x1dc0 [ 47.002500] __dev_queue_xmit+0x1528/0x21f8 [ 47.006692] dev_queue_xmit+0x24/0x30 [ 47.010366] neigh_resolve_output+0x37c/0x678 [ 47.014734] ip_finish_output2+0x598/0x2458 [ 47.018927] __ip_finish_output+0x300/0x730 [ 47.023118] ip_output+0x2e0/0x430 [ 47.026530] ip_local_out+0x90/0x140 [ 47.030117] igmpv3_sendpack+0x14c/0x228 [ 47.034049] igmpv3_send_cr+0x384/0x6b8 [ 47.037895] igmp_ifc_timer_expire+0x4c/0x118 [ 47.042262] call_timer_fn+0x1cc/0xbe8 [ 47.046021] __run_timers+0x4d8/0xb28 [ 47.049693] run_timer_softirq+0x24/0x40 [ 47.053626] __do_softirq+0x2c0/0x117c [ 47.057387] irq_exit+0x2dc/0x388 [ 47.060715] __handle_domain_irq+0xb4/0x158 [ 47.064908] gic_handle_irq+0x58/0xb0 [ 47.068581] el0_irq_naked+0x50/0x5c [ 47.072162] [ 47.073665] Allocated by task 328: [ 47.077083] save_stack+0x24/0xb0 [ 47.080410] __kasan_kmalloc.isra.0+0xc0/0xe0 [ 47.084776] kasan_slab_alloc+0x14/0x20 [ 47.088622] kmem_cache_alloc+0x15c/0x468 [ 47.092643] __alloc_skb+0xa4/0x498 [ 47.096142] igmpv3_newpack+0x158/0xd78 [ 47.099987] add_grhead+0x210/0x288 [ 47.103485] add_grec+0x6b0/0xb70 [ 47.106811] igmpv3_send_cr+0x2e0/0x6b8 [ 47.110657] igmp_ifc_timer_expire+0x4c/0x118 [ 47.115027] call_timer_fn+0x1cc/0xbe8 [ 47.118785] __run_timers+0x4d8/0xb28 [ 47.122457] run_timer_softirq+0x24/0x40 [ 47.126389] __do_softirq+0x2c0/0x117c [ 47.130142] [ 47.131643] Freed by task 180: [ 47.134712] save_stack+0x24/0xb0 [ 47.138041] __kasan_slab_free+0x108/0x180 [ 47.142146] kasan_slab_free+0x10/0x18 [ 47.145904] slab_free_freelist_hook+0xa4/0x1b0 [ 47.150444] kmem_cache_free+0x8c/0x528 [ 47.154292] kfree_skbmem+0x94/0x108 [ 47.157880] consume_skb+0x10c/0x5a8 [ 47.161466] __dev_kfree_skb_any+0x88/0xa0 [ 47.165598] brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil] [ 47.171023] brcmf_txfinalize+0xec/0x190 [brcmfmac] [ 47.176016] brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac] [ 47.182056] brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac] [ 47.187568] brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac] [ 47.192529] brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac] [ 47.197859] process_one_work+0x7fc/0x1a80 [ 47.201965] worker_thread+0x31c/0xc40 [ 47.205726] kthread+0x2d8/0x370 [ 47.208967] ret_from_fork+0x10/0x18 [ 47.212546] [ 47.214051] The buggy address belongs to the object at ffffff803f588280 [ 47.214051] which belongs to the cache skbuff_head_cache of size 208 [ 47.227086] The buggy address is located 104 bytes inside of [ 47.227086] 208-byte region [ffffff803f588280, ffffff803f588350) [ 47.238814] The buggy address belongs to the page: [ 47.243618] page:ffffffff00dd6200 refcount:1 mapcou ---truncated--- Important CVE-2022-50408 at SUSE CVE-2022-50408 at NVD SUSE bug 1250391 SUSE bug 1250419 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. Moderate CVE-2022-50410 at SUSE CVE-2022-50410 at NVD SUSE bug 1250187 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710 CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370 Call Trace: <TASK> dump_stack_lvl+0x73/0x9f print_report+0x25d/0x759 kasan_report+0xc0/0x120 __asan_load8+0x99/0x140 __list_add_valid+0x28/0x1a0 ext4_orphan_cleanup+0x564/0x9d0 [ext4] __ext4_fill_super+0x48e2/0x5300 [ext4] ext4_fill_super+0x19f/0x3a0 [ext4] get_tree_bdev+0x27b/0x450 ext4_get_tree+0x19/0x30 [ext4] vfs_get_tree+0x49/0x150 path_mount+0xaae/0x1350 do_mount+0xe2/0x110 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup --- loop1: assume last_orphan is 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan) ext4_truncate --> return 0 ext4_inode_attach_jinode --> return -ENOMEM iput(inode) --> free inode<12> --- loop2: last_orphan is still 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan); // use inode<12> and trigger UAF To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately. Important CVE-2022-50673 at SUSE CVE-2022-50673 at NVD SUSE bug 1255521 SUSE bug 1255522 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. Important CVE-2023-0286 at SUSE CVE-2023-0286 at NVD SUSE bug 1207533 SUSE bug 1207569 SUSE bug 1211136 SUSE bug 1211503 SUSE bug 1213146 SUSE bug 1214269 SUSE bug 1218477 SUSE bug 1218967 SUSE bug 1225677 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1. Important CVE-2023-0430 at SUSE CVE-2023-0430 at NVD SUSE bug 1207858 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. Important CVE-2023-0494 at SUSE CVE-2023-0494 at NVD SUSE bug 1207783 SUSE bug 1208344 SUSE bug 1209331 SUSE bug 1211551 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10. Moderate CVE-2023-0547 at SUSE CVE-2023-0547 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted message with this structure to attempt a DoS attack. This vulnerability affects Thunderbird < 102.8. Critical CVE-2023-0616 at SUSE CVE-2023-0616 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Important CVE-2023-0767 at SUSE CVE-2023-0767 at NVD SUSE bug 1208138 SUSE bug 1213200 SUSE bug 1213818 SUSE bug 1214271 SUSE bug 1218481 SUSE bug 1218964 SUSE bug 1225630 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. Important CVE-2023-1393 at SUSE CVE-2023-1393 at NVD SUSE bug 1209543 SUSE bug 1210895 SUSE bug 1211551 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10. Moderate CVE-2023-1945 at SUSE CVE-2023-1945 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. Important CVE-2023-1999 at SUSE CVE-2023-1999 at NVD SUSE bug 1213054 SUSE bug 1217159 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. Important CVE-2023-2002 at SUSE CVE-2023-2002 at NVD SUSE bug 1210533 SUSE bug 1210566 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Moderate CVE-2023-20569 at SUSE CVE-2023-20569 at NVD SUSE bug 1213287 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity. Moderate CVE-2023-20592 at SUSE CVE-2023-20592 at NVD SUSE bug 1215823 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. Moderate CVE-2023-20593 at SUSE CVE-2023-20593 at NVD SUSE bug 1213286 SUSE bug 1213616 SUSE bug 1215674 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Moderate CVE-2023-20867 at SUSE CVE-2023-20867 at NVD SUSE bug 1212143 SUSE bug 1214402 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . Important CVE-2023-20900 at SUSE CVE-2023-20900 at NVD SUSE bug 1214566 SUSE bug 1216432 SUSE bug 1216433 SUSE bug 1225628 SUSE bug 1228309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-21830 at SUSE CVE-2023-21830 at NVD SUSE bug 1207249 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-21835 at SUSE CVE-2023-21835 at NVD SUSE bug 1207246 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-21843 at SUSE CVE-2023-21843 at NVD SUSE bug 1207248 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Important CVE-2023-21930 at SUSE CVE-2023-21930 at NVD SUSE bug 1210628 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-21937 at SUSE CVE-2023-21937 at NVD SUSE bug 1210631 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-21938 at SUSE CVE-2023-21938 at NVD SUSE bug 1210632 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-21939 at SUSE CVE-2023-21939 at NVD SUSE bug 1210634 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-21954 at SUSE CVE-2023-21954 at NVD SUSE bug 1210635 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-21967 at SUSE CVE-2023-21967 at NVD SUSE bug 1210636 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-21968 at SUSE CVE-2023-21968 at NVD SUSE bug 1210637 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-22006 at SUSE CVE-2023-22006 at NVD SUSE bug 1213473 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-22036 at SUSE CVE-2023-22036 at NVD SUSE bug 1213474 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-22041 at SUSE CVE-2023-22041 at NVD SUSE bug 1213475 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-22045 at SUSE CVE-2023-22045 at NVD SUSE bug 1213481 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Low CVE-2023-22049 at SUSE CVE-2023-22049 at NVD SUSE bug 1213482 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-22067 at SUSE CVE-2023-22067 at NVD SUSE bug 1216379 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2023-22081 at SUSE CVE-2023-22081 at NVD SUSE bug 1216374 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. Important CVE-2023-22809 at SUSE CVE-2023-22809 at NVD SUSE bug 1207082 SUSE bug 1208053 SUSE bug 1209326 SUSE bug 1214446 SUSE bug 1225623 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to `DataTransfer.setData`. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23598 at SUSE CVE-2023-23598 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23599 at SUSE CVE-2023-23599 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23601 at SUSE CVE-2023-23601 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23602 at SUSE CVE-2023-23602 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23603 at SUSE CVE-2023-23603 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Important CVE-2023-23605 at SUSE CVE-2023-23605 at NVD SUSE bug 1207119 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Important CVE-2023-24329 at SUSE CVE-2023-24329 at NVD SUSE bug 1208471 SUSE bug 1213553 SUSE bug 1213554 SUSE bug 1213839 SUSE bug 1225672 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Important CVE-2023-25193 at SUSE CVE-2023-25193 at NVD SUSE bug 1207922 SUSE bug 1213939 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. Important CVE-2023-25652 at SUSE CVE-2023-25652 at NVD SUSE bug 1210686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server. Important CVE-2023-25690 at SUSE CVE-2023-25690 at NVD SUSE bug 1209047 SUSE bug 1212409 SUSE bug 1212865 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25728 at SUSE CVE-2023-25728 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25729 at SUSE CVE-2023-25729 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25730 at SUSE CVE-2023-25730 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25732 at SUSE CVE-2023-25732 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25735 at SUSE CVE-2023-25735 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25737 at SUSE CVE-2023-25737 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25739 at SUSE CVE-2023-25739 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Critical CVE-2023-25742 at SUSE CVE-2023-25742 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8. Critical CVE-2023-25743 at SUSE CVE-2023-25743 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8. Critical CVE-2023-25744 at SUSE CVE-2023-25744 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8. Critical CVE-2023-25746 at SUSE CVE-2023-25746 at NVD SUSE bug 1208144 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Important CVE-2023-25751 at SUSE CVE-2023-25751 at NVD SUSE bug 1209173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Important CVE-2023-25752 at SUSE CVE-2023-25752 at NVD SUSE bug 1209173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Moderate CVE-2023-25775 at SUSE CVE-2023-25775 at NVD SUSE bug 1216959 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output. Important CVE-2023-26604 at SUSE CVE-2023-26604 at NVD SUSE bug 1208958 SUSE bug 1210451 SUSE Liberty Linux 7 While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Important CVE-2023-28162 at SUSE CVE-2023-28162 at NVD SUSE bug 1209173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Important CVE-2023-28164 at SUSE CVE-2023-28164 at NVD SUSE bug 1209173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. Important CVE-2023-28176 at SUSE CVE-2023-28176 at NVD SUSE bug 1209173 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. Important CVE-2023-2828 at SUSE CVE-2023-2828 at NVD SUSE bug 1212544 SUSE bug 1216764 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This vulnerability is distinct from GHSA-rfv9-x7hh-xc32 which covers a similar issue. The issue has been patched in matrix-js-sdk 24.0.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-28427 at SUSE CVE-2023-28427 at NVD SUSE bug 1209953 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. Important CVE-2023-29007 at SUSE CVE-2023-29007 at NVD SUSE bug 1210686 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ribose RNP before 0.16.3 may hang when the input is malformed. Moderate CVE-2023-29479 at SUSE CVE-2023-29479 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29533 at SUSE CVE-2023-29533 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29535 at SUSE CVE-2023-29535 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29536 at SUSE CVE-2023-29536 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29539 at SUSE CVE-2023-29539 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29541 at SUSE CVE-2023-29541 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29548 at SUSE CVE-2023-29548 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Moderate CVE-2023-29550 at SUSE CVE-2023-29550 at NVD SUSE bug 1210212 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution. Important CVE-2023-31315 at SUSE CVE-2023-31315 at NVD SUSE bug 1229069 SUSE Liberty Linux 7 LTSS CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Important CVE-2023-31484 at SUSE CVE-2023-31484 at NVD SUSE bug 1210999 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. Important CVE-2023-32067 at SUSE CVE-2023-32067 at NVD SUSE bug 1211604 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32205 at SUSE CVE-2023-32205 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32206 at SUSE CVE-2023-32206 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32207 at SUSE CVE-2023-32207 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32211 at SUSE CVE-2023-32211 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32212 at SUSE CVE-2023-32212 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32213 at SUSE CVE-2023-32213 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Critical CVE-2023-32215 at SUSE CVE-2023-32215 at NVD SUSE bug 1211175 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Important CVE-2023-32233 at SUSE CVE-2023-32233 at NVD SUSE bug 1211043 SUSE bug 1211187 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents. Moderate CVE-2023-32360 at SUSE CVE-2023-32360 at NVD SUSE bug 1214254 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. Important CVE-2023-3341 at SUSE CVE-2023-3341 at NVD SUSE bug 1215472 SUSE bug 1216764 SUSE bug 1217453 SUSE bug 1217551 SUSE bug 1217600 SUSE bug 1221586 SUSE bug 1223092 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . Important CVE-2023-34058 at SUSE CVE-2023-34058 at NVD SUSE bug 1216432 SUSE bug 1216433 SUSE bug 1228309 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs. Important CVE-2023-34059 at SUSE CVE-2023-34059 at NVD SUSE bug 1216433 SUSE bug 1225967 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1. Important CVE-2023-3417 at SUSE CVE-2023-3417 at NVD SUSE bug 1213658 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. Important CVE-2023-34414 at SUSE CVE-2023-34414 at NVD SUSE bug 1211922 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. Important CVE-2023-34416 at SUSE CVE-2023-34416 at NVD SUSE bug 1211922 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2023-34440 at SUSE CVE-2023-34440 at NVD SUSE Liberty Linux 7 Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Important CVE-2023-35001 at SUSE CVE-2023-35001 at NVD SUSE bug 1213059 SUSE bug 1213063 SUSE bug 1217531 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Important CVE-2023-35788 at SUSE CVE-2023-35788 at NVD SUSE bug 1212504 SUSE bug 1212509 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1. Important CVE-2023-3600 at SUSE CVE-2023-3600 at NVD SUSE bug 1213230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. Important CVE-2023-3609 at SUSE CVE-2023-3609 at NVD SUSE bug 1213586 SUSE bug 1213587 SUSE bug 1217444 SUSE bug 1217531 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. Moderate CVE-2023-3611 at SUSE CVE-2023-3611 at NVD SUSE bug 1213585 SUSE bug 1223091 SUSE bug 1223973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37201 at SUSE CVE-2023-37201 at NVD SUSE bug 1212438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37202 at SUSE CVE-2023-37202 at NVD SUSE bug 1212438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37207 at SUSE CVE-2023-37207 at NVD SUSE bug 1212438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37208 at SUSE CVE-2023-37208 at NVD SUSE bug 1212438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37211 at SUSE CVE-2023-37211 at NVD SUSE bug 1212438 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue. Important CVE-2023-37460 at SUSE CVE-2023-37460 at NVD SUSE bug 1215973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. Important CVE-2023-37536 at SUSE CVE-2023-37536 at NVD SUSE bug 1216156 SUSE bug 1219472 SUSE bug 1219708 SUSE bug 1221037 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. Important CVE-2023-3776 at SUSE CVE-2023-3776 at NVD SUSE bug 1213588 SUSE bug 1215119 SUSE bug 1215674 SUSE bug 1217444 SUSE bug 1217531 SUSE bug 1221578 SUSE bug 1221598 SUSE bug 1223091 SUSE bug 1223973 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Important CVE-2023-38403 at SUSE CVE-2023-38403 at NVD SUSE bug 1213430 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. Important CVE-2023-38408 at SUSE CVE-2023-38408 at NVD SUSE bug 1213504 SUSE bug 1217034 SUSE bug 1217035 SUSE bug 1218970 SUSE bug 1225676 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info). Moderate CVE-2023-38409 at SUSE CVE-2023-38409 at NVD SUSE bug 1213417 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) Important CVE-2023-40217 at SUSE CVE-2023-40217 at NVD SUSE bug 1214692 SUSE bug 1217524 SUSE bug 1218319 SUSE bug 1218476 SUSE bug 1218965 SUSE bug 1219472 SUSE bug 1219713 SUSE bug 1221582 SUSE bug 1224883 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4045 at SUSE CVE-2023-4045 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4046 at SUSE CVE-2023-4046 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4047 at SUSE CVE-2023-4047 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4048 at SUSE CVE-2023-4048 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4049 at SUSE CVE-2023-4049 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4050 at SUSE CVE-2023-4050 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Moderate CVE-2023-4051 at SUSE CVE-2023-4051 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Moderate CVE-2023-4053 at SUSE CVE-2023-4053 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances. Moderate CVE-2023-40546 at SUSE CVE-2023-40546 at NVD SUSE bug 1215099 SUSE Liberty Linux 7 LTSS A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully. Important CVE-2023-40547 at SUSE CVE-2023-40547 at NVD SUSE bug 1215098 SUSE Liberty Linux 7 LTSS A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase. Moderate CVE-2023-40548 at SUSE CVE-2023-40548 at NVD SUSE bug 1215100 SUSE Liberty Linux 7 LTSS An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service. Moderate CVE-2023-40549 at SUSE CVE-2023-40549 at NVD SUSE bug 1215101 SUSE Liberty Linux 7 When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4055 at SUSE CVE-2023-4055 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phase. Moderate CVE-2023-40550 at SUSE CVE-2023-40550 at NVD SUSE bug 1215102 SUSE Liberty Linux 7 LTSS A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase. Moderate CVE-2023-40551 at SUSE CVE-2023-40551 at NVD SUSE bug 1215103 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4056 at SUSE CVE-2023-4056 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Moderate CVE-2023-4057 at SUSE CVE-2023-4057 at NVD SUSE bug 1213746 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage. Important CVE-2023-4128 at SUSE CVE-2023-4128 at NVD SUSE bug 1214149 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. Important CVE-2023-4206 at SUSE CVE-2023-4206 at NVD SUSE bug 1215110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. Important CVE-2023-4207 at SUSE CVE-2023-4207 at NVD SUSE bug 1215113 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. Important CVE-2023-4208 at SUSE CVE-2023-4208 at NVD SUSE bug 1215114 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Important CVE-2023-42753 at SUSE CVE-2023-42753 at NVD SUSE bug 1215150 SUSE bug 1218613 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2023-43758 at SUSE CVE-2023-43758 at NVD SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Important CVE-2023-4408 at SUSE CVE-2023-4408 at NVD SUSE bug 1219823 SUSE bug 1219851 SUSE bug 1221586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. Important CVE-2023-44271 at SUSE CVE-2023-44271 at NVD SUSE bug 1216894 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299. Important CVE-2023-44446 at SUSE CVE-2023-44446 at NVD SUSE bug 1217213 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. Important CVE-2023-44488 at SUSE CVE-2023-44488 at NVD SUSE bug 1216879 SUSE bug 1217559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4573 at SUSE CVE-2023-4573 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4574 at SUSE CVE-2023-4574 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4575 at SUSE CVE-2023-4575 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4577 at SUSE CVE-2023-4577 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4578 at SUSE CVE-2023-4578 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4580 at SUSE CVE-2023-4580 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4581 at SUSE CVE-2023-4581 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4583 at SUSE CVE-2023-4583 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4584 at SUSE CVE-2023-4584 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4585 at SUSE CVE-2023-4585 at NVD SUSE bug 1214606 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. Moderate CVE-2023-45871 at SUSE CVE-2023-45871 at NVD SUSE bug 1216259 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. Important CVE-2023-4622 at SUSE CVE-2023-4622 at NVD SUSE bug 1215117 SUSE bug 1215442 SUSE bug 1217531 SUSE bug 1219699 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. Important CVE-2023-4623 at SUSE CVE-2023-4623 at NVD SUSE bug 1215115 SUSE bug 1215440 SUSE bug 1217444 SUSE bug 1217531 SUSE bug 1219698 SUSE bug 1221578 SUSE bug 1221598 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. Important CVE-2023-46724 at SUSE CVE-2023-46724 at NVD SUSE bug 1216803 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests. Important CVE-2023-46728 at SUSE CVE-2023-46728 at NVD SUSE bug 1216926 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. Important CVE-2023-46847 at SUSE CVE-2023-46847 at NVD SUSE bug 1216495 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege. Important CVE-2023-4727 at SUSE CVE-2023-4727 at NVD SUSE Liberty Linux 7 Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-4863 at SUSE CVE-2023-4863 at NVD SUSE bug 1215231 SUSE bug 1217115 SUSE bug 1217117 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. Important CVE-2023-4921 at SUSE CVE-2023-4921 at NVD SUSE bug 1215275 SUSE bug 1215300 SUSE bug 1217444 SUSE bug 1217531 SUSE bug 1220906 SUSE bug 1223091 SUSE bug 1224418 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-49285 at SUSE CVE-2023-49285 at NVD SUSE bug 1217813 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-49286 at SUSE CVE-2023-49286 at NVD SUSE bug 1217815 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Important CVE-2023-50269 at SUSE CVE-2023-50269 at NVD SUSE bug 1217654 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. Important CVE-2023-50387 at SUSE CVE-2023-50387 at NVD SUSE bug 1219823 SUSE bug 1220717 SUSE bug 1221586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter). Important CVE-2023-50447 at SUSE CVE-2023-50447 at NVD SUSE bug 1219048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6. Important CVE-2023-50761 at SUSE CVE-2023-50761 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6. Important CVE-2023-50762 at SUSE CVE-2023-50762 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. Important CVE-2023-50868 at SUSE CVE-2023-50868 at NVD SUSE bug 1219823 SUSE bug 1219826 SUSE bug 1221586 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5169 at SUSE CVE-2023-5169 at NVD SUSE bug 1215575 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5171 at SUSE CVE-2023-5171 at NVD SUSE bug 1215575 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5176 at SUSE CVE-2023-5176 at NVD SUSE bug 1215575 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-5217 at SUSE CVE-2023-5217 at NVD SUSE bug 1215776 SUSE bug 1215778 SUSE bug 1215814 SUSE bug 1217559 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0 bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op. Moderate CVE-2023-52922 at SUSE CVE-2023-52922 at NVD SUSE bug 1233977 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents. Moderate CVE-2023-53125 at SUSE CVE-2023-53125 at NVD SUSE bug 1242285 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page. The race unfolds like this: 1. a page with data A and swap offset X is stored in zswap 2. page A is removed off the LRU by zpool driver for writeback in zswap-shrink work, data for A is mapped by zpool driver 3. user space program faults and invalidates page entry A, offset X is considered free 4. kswapd stores page B at offset X in zswap (zswap could also be full, if so, page B would then be IOed to X, then skip step 5.) 5. entry A is replaced by B in tree->rbroot, this doesn't affect the local reference held by zswap-shrink work 6. zswap-shrink work writes back A at X, and frees zswap entry A 7. swapin of slot X brings A in memory instead of B The fix: Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW), zswap-shrink work just checks that the local zswap_entry reference is still the same as the one in the tree. If it's not the same it means that it's either been invalidated or replaced, in both cases the writeback is aborted because the local entry contains stale data. Reproducer: I originally found this by running `stress` overnight to validate my work on the zswap writeback mechanism, it manifested after hours on my test machine. The key to make it happen is having zswap writebacks, so whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do the trick. In order to reproduce this faster on a vm, I setup a system with ~100M of available memory and a 500M swap file, then running `stress --vm 1 --vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens of minutes. One can speed things up even more by swinging /sys/module/zswap/parameters/max_pool_percent up and down between, say, 20 and 1; this makes it reproduce in tens of seconds. It's crucial to set `--vm-stride` to something other than 4096 otherwise `stress` won't realize that memory has been corrupted because all pages would have the same data. Moderate CVE-2023-53178 at SUSE CVE-2023-53178 at NVD SUSE bug 1249827 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. Important CVE-2023-53297 at SUSE CVE-2023-53297 at NVD SUSE bug 1250322 SUSE bug 1250728 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. Moderate CVE-2023-53305 at SUSE CVE-2023-53305 at NVD SUSE bug 1250049 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same resource. Wait for IO's to return to upper layer before resources are freed. Moderate CVE-2023-53322 at SUSE CVE-2023-53322 at NVD SUSE bug 1250323 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20 When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails. Moderate CVE-2023-53365 at SUSE CVE-2023-53365 at NVD SUSE bug 1249988 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. Moderate CVE-2023-53373 at SUSE CVE-2023-53373 at NVD SUSE bug 1250137 SUSE Liberty Linux 7 A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service. Important CVE-2023-5367 at SUSE CVE-2023-5367 at NVD SUSE bug 1216135 SUSE bug 1217447 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). Moderate CVE-2023-53675 at SUSE CVE-2023-53675 at NVD SUSE bug 1251325 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Moderate CVE-2023-53705 at SUSE CVE-2023-53705 at NVD SUSE bug 1252554 SUSE Liberty Linux 7 A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. Moderate CVE-2023-5380 at SUSE CVE-2023-5380 at NVD SUSE bug 1216133 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Moderate CVE-2023-5388 at SUSE CVE-2023-5388 at NVD SUSE bug 1216198 SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. Moderate CVE-2023-5455 at SUSE CVE-2023-5455 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5721 at SUSE CVE-2023-5721 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5724 at SUSE CVE-2023-5724 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5725 at SUSE CVE-2023-5725 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5728 at SUSE CVE-2023-5728 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5730 at SUSE CVE-2023-5730 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and Thunderbird < 115.4.1. Important CVE-2023-5732 at SUSE CVE-2023-5732 at NVD SUSE bug 1216338 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory. Critical CVE-2023-5869 at SUSE CVE-2023-5869 at NVD SUSE bug 1216961 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 On some systems-depending on the graphics settings and drivers-it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6204 at SUSE CVE-2023-6204 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6205 at SUSE CVE-2023-6205 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6206 at SUSE CVE-2023-6206 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6207 at SUSE CVE-2023-6207 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6208 at SUSE CVE-2023-6208 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6209 at SUSE CVE-2023-6209 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Important CVE-2023-6212 at SUSE CVE-2023-6212 at NVD SUSE bug 1217230 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved. Important CVE-2023-6377 at SUSE CVE-2023-6377 at NVD SUSE bug 1217765 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. Important CVE-2023-6478 at SUSE CVE-2023-6478 at NVD SUSE bug 1217766 SUSE bug 1222096 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. Important CVE-2023-6816 at SUSE CVE-2023-6816 at NVD SUSE bug 1218582 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6856 at SUSE CVE-2023-6856 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6857 at SUSE CVE-2023-6857 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6858 at SUSE CVE-2023-6858 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6859 at SUSE CVE-2023-6859 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6860 at SUSE CVE-2023-6860 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6861 at SUSE CVE-2023-6861 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. Important CVE-2023-6862 at SUSE CVE-2023-6862 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6863 at SUSE CVE-2023-6863 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Important CVE-2023-6864 at SUSE CVE-2023-6864 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. Important CVE-2023-6865 at SUSE CVE-2023-6865 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. Important CVE-2023-6867 at SUSE CVE-2023-6867 at NVD SUSE bug 1217974 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments. Important CVE-2024-0229 at SUSE CVE-2024-0229 at NVD SUSE bug 1218583 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. Moderate CVE-2024-0408 at SUSE CVE-2024-0408 at NVD SUSE bug 1218845 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. Moderate CVE-2024-0409 at SUSE CVE-2024-0409 at NVD SUSE bug 1218846 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0741 at SUSE CVE-2024-0741 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0742 at SUSE CVE-2024-0742 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-0743 at SUSE CVE-2024-0743 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0746 at SUSE CVE-2024-0746 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0747 at SUSE CVE-2024-0747 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7. Important CVE-2024-0749 at SUSE CVE-2024-0749 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0750 at SUSE CVE-2024-0750 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0751 at SUSE CVE-2024-0751 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0753 at SUSE CVE-2024-0753 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Important CVE-2024-0755 at SUSE CVE-2024-0755 at NVD SUSE bug 1218955 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. Important CVE-2024-1086 at SUSE CVE-2024-1086 at NVD SUSE bug 1219434 SUSE bug 1219435 SUSE bug 1224298 SUSE bug 1224878 SUSE bug 1226066 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. Important CVE-2024-10979 at SUSE CVE-2024-10979 at NVD SUSE bug 1233327 SUSE Liberty Linux 7 LTSS It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1. Important CVE-2024-11187 at SUSE CVE-2024-11187 at NVD SUSE bug 1236596 SUSE Liberty Linux 7 LTSS A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Moderate CVE-2024-12085 at SUSE CVE-2024-12085 at NVD SUSE bug 1233760 SUSE bug 1234101 SUSE Liberty Linux 7 LTSS A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. Important CVE-2024-12087 at SUSE CVE-2024-12087 at NVD SUSE bug 1233760 SUSE bug 1234103 SUSE Liberty Linux 7 When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1546 at SUSE CVE-2024-1546 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1547 at SUSE CVE-2024-1547 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1548 at SUSE CVE-2024-1548 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1549 at SUSE CVE-2024-1549 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1550 at SUSE CVE-2024-1550 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1551 at SUSE CVE-2024-1551 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1552 at SUSE CVE-2024-1552 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Critical CVE-2024-1553 at SUSE CVE-2024-1553 at NVD SUSE bug 1220048 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. Important CVE-2024-1737 at SUSE CVE-2024-1737 at NVD SUSE bug 1228256 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1. Important CVE-2024-1936 at SUSE CVE-2024-1936 at NVD SUSE bug 1221054 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1. Important CVE-2024-1975 at SUSE CVE-2024-1975 at NVD SUSE bug 1228257 SUSE Liberty Linux 7 Unknown. Important CVE-2024-20918 at SUSE CVE-2024-20918 at NVD SUSE bug 1218907 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2024-20919 at SUSE CVE-2024-20919 at NVD SUSE bug 1218903 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2024-20921 at SUSE CVE-2024-20921 at NVD SUSE bug 1218905 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2024-20926 at SUSE CVE-2024-20926 at NVD SUSE bug 1218906 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Moderate CVE-2024-20945 at SUSE CVE-2024-20945 at NVD SUSE bug 1218909 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Unknown. Important CVE-2024-20952 at SUSE CVE-2024-20952 at NVD SUSE bug 1218911 SUSE bug 1219843 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21011 at SUSE CVE-2024-21011 at NVD SUSE bug 1222979 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21012 at SUSE CVE-2024-21012 at NVD SUSE bug 1222987 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21068 at SUSE CVE-2024-21068 at NVD SUSE bug 1222983 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21085 at SUSE CVE-2024-21085 at NVD SUSE bug 1222984 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21094 at SUSE CVE-2024-21094 at NVD SUSE bug 1222986 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21131 at SUSE CVE-2024-21131 at NVD SUSE bug 1228046 SUSE Liberty Linux 7 LTSS Unknown. Low CVE-2024-21138 at SUSE CVE-2024-21138 at NVD SUSE bug 1228047 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2024-21140 at SUSE CVE-2024-21140 at NVD SUSE bug 1228048 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2024-21144 at SUSE CVE-2024-21144 at NVD SUSE bug 1228050 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2024-21145 at SUSE CVE-2024-21145 at NVD SUSE bug 1228051 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2024-21147 at SUSE CVE-2024-21147 at NVD SUSE bug 1228052 SUSE Liberty Linux 7 LTSS runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. Important CVE-2024-21626 at SUSE CVE-2024-21626 at NVD SUSE bug 1218894 SUSE Liberty Linux 7 A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. Important CVE-2024-21885 at SUSE CVE-2024-21885 at NVD SUSE bug 1218584 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments. Important CVE-2024-21886 at SUSE CVE-2024-21886 at NVD SUSE bug 1218585 SUSE bug 1221590 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. Moderate CVE-2024-2199 at SUSE CVE-2024-2199 at NVD SUSE bug 1225507 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems. Moderate CVE-2024-2201 at SUSE CVE-2024-2201 at NVD SUSE bug 1212111 SUSE bug 1217339 SUSE Liberty Linux 7 LTSS Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access. Important CVE-2024-24582 at SUSE CVE-2024-24582 at NVD SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 Important CVE-2024-25617 at SUSE CVE-2024-25617 at NVD SUSE bug 1219960 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2607 at SUSE CVE-2024-2607 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2608 at SUSE CVE-2024-2608 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-2609 at SUSE CVE-2024-2609 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2610 at SUSE CVE-2024-2610 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2611 at SUSE CVE-2024-2611 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2612 at SUSE CVE-2024-2612 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Important CVE-2024-2614 at SUSE CVE-2024-2614 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9. Important CVE-2024-2616 at SUSE CVE-2024-2616 at NVD SUSE bug 1221327 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine. Moderate CVE-2024-26602 at SUSE CVE-2024-26602 at NVD SUSE bug 1220398 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2024-28127 at SUSE CVE-2024-28127 at NVD SUSE Liberty Linux 7 LTSS Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2024-28956 at SUSE CVE-2024-28956 at NVD SUSE bug 1242006 SUSE Liberty Linux 7 LTSS Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2024-29214 at SUSE CVE-2024-29214 at NVD SUSE Liberty Linux 7 The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. Important CVE-2024-2961 at SUSE CVE-2024-2961 at NVD SUSE bug 1222992 SUSE bug 1223019 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1. Important CVE-2024-29944 at SUSE CVE-2024-29944 at NVD SUSE bug 1221850 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. Important CVE-2024-31080 at SUSE CVE-2024-31080 at NVD SUSE bug 1222309 SUSE bug 1222312 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. Important CVE-2024-31081 at SUSE CVE-2024-31081 at NVD SUSE bug 1222310 SUSE bug 1222312 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. Important CVE-2024-31083 at SUSE CVE-2024-31083 at NVD SUSE bug 1222312 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user's password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal's password). Important CVE-2024-3183 at SUSE CVE-2024-3183 at NVD cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6. Important CVE-2024-32462 at SUSE CVE-2024-32462 at NVD SUSE bug 1223110 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. Important CVE-2024-32487 at SUSE CVE-2024-32487 at NVD SUSE bug 1222849 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3302 at SUSE CVE-2024-3302 at NVD SUSE bug 1222535 SUSE Liberty Linux 7 nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Important CVE-2024-33599 at SUSE CVE-2024-33599 at NVD SUSE bug 1223423 SUSE bug 1223530 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Important CVE-2024-33600 at SUSE CVE-2024-33600 at NVD SUSE bug 1222992 SUSE bug 1223424 SUSE bug 1223589 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Moderate CVE-2024-33601 at SUSE CVE-2024-33601 at NVD SUSE bug 1223426 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Moderate CVE-2024-33602 at SUSE CVE-2024-33602 at NVD SUSE bug 1223425 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded. Important CVE-2024-33871 at SUSE CVE-2024-33871 at NVD SUSE bug 1225491 SUSE Liberty Linux 7 LTSS RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Important CVE-2024-3596 at SUSE CVE-2024-3596 at NVD SUSE bug 1223414 SUSE Liberty Linux 7 LTSS A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size. Moderate CVE-2024-3651 at SUSE CVE-2024-3651 at NVD SUSE bug 1222842 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service Important CVE-2024-3657 at SUSE CVE-2024-3657 at NVD SUSE bug 1225512 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Important CVE-2024-36971 at SUSE CVE-2024-36971 at NVD SUSE bug 1226145 SUSE bug 1226324 SUSE Liberty Linux 7 LTSS In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application. Important CVE-2024-37370 at SUSE CVE-2024-37370 at NVD SUSE bug 1227186 SUSE bug 1227187 SUSE Liberty Linux 7 LTSS In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. Moderate CVE-2024-37371 at SUSE CVE-2024-37371 at NVD SUSE bug 1227186 SUSE bug 1227187 SUSE Liberty Linux 7 LTSS Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. Important CVE-2024-38474 at SUSE CVE-2024-38474 at NVD SUSE bug 1227278 SUSE Liberty Linux 7 LTSS Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. Important CVE-2024-38475 at SUSE CVE-2024-38475 at NVD SUSE bug 1227268 SUSE Liberty Linux 7 LTSS Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Important CVE-2024-38476 at SUSE CVE-2024-38476 at NVD SUSE bug 1227269 SUSE Liberty Linux 7 LTSS null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Important CVE-2024-38477 at SUSE CVE-2024-38477 at NVD SUSE bug 1227270 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3852 at SUSE CVE-2024-3852 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3854 at SUSE CVE-2024-3854 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3857 at SUSE CVE-2024-3857 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3859 at SUSE CVE-2024-3859 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3861 at SUSE CVE-2024-3861 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Important CVE-2024-3864 at SUSE CVE-2024-3864 at NVD SUSE bug 1222535 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed.. Important CVE-2024-39936 at SUSE CVE-2024-39936 at NVD SUSE bug 1227426 SUSE Liberty Linux 7 LTSS This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Moderate CVE-2024-41071 at SUSE CVE-2024-41071 at NVD SUSE bug 1228625 SUSE Liberty Linux 7 LTSS Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission. Important CVE-2024-42472 at SUSE CVE-2024-42472 at NVD SUSE bug 1229157 SUSE Liberty Linux 7 LTSS Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Atom(R) processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2024-43420 at SUSE CVE-2024-43420 at NVD SUSE bug 1242006 SUSE bug 1243451 SUSE Liberty Linux 7 A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4367 at SUSE CVE-2024-4367 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2024-45332 at SUSE CVE-2024-45332 at NVD SUSE bug 1242006 SUSE bug 1243180 SUSE Liberty Linux 7 LTSS A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections. Moderate CVE-2024-45781 at SUSE CVE-2024-45781 at NVD SUSE bug 1233617 SUSE Liberty Linux 7 LTSS A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass. Moderate CVE-2024-45782 at SUSE CVE-2024-45782 at NVD SUSE bug 1233615 SUSE Liberty Linux 7 LTSS Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid version 6.10. Moderate CVE-2024-45802 at SUSE CVE-2024-45802 at NVD SUSE bug 1232485 SUSE Liberty Linux 7 LTSS CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. The `cfGetPrinterAttributes5` function in `libcupsfilters` does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system. Important CVE-2024-47076 at SUSE CVE-2024-47076 at NVD SUSE bug 1230932 SUSE bug 1230937 SUSE Liberty Linux 7 LTSS CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176. Important CVE-2024-47175 at SUSE CVE-2024-47175 at NVD SUSE bug 1230932 SUSE Liberty Linux 7 LTSS CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to. Important CVE-2024-47176 at SUSE CVE-2024-47176 at NVD SUSE bug 1230932 SUSE bug 1230939 SUSE Liberty Linux 7 LTSS Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files. Moderate CVE-2024-47252 at SUSE CVE-2024-47252 at NVD SUSE bug 1246303 SUSE Liberty Linux 7 If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4767 at SUSE CVE-2024-4767 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4768 at SUSE CVE-2024-4768 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4769 at SUSE CVE-2024-4769 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4770 at SUSE CVE-2024-4770 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Important CVE-2024-4777 at SUSE CVE-2024-4777 at NVD SUSE bug 1224056 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.) Moderate CVE-2024-47850 at SUSE CVE-2024-47850 at NVD SUSE bug 1231294 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. Important CVE-2024-50302 at SUSE CVE-2024-50302 at NVD SUSE bug 1233491 SUSE bug 1233679 SUSE Liberty Linux 7 LTSS A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations. Moderate CVE-2024-52337 at SUSE CVE-2024-52337 at NVD SUSE bug 1233807 SUSE Liberty Linux 7 LTSS GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. Important CVE-2024-52530 at SUSE CVE-2024-52530 at NVD SUSE bug 1233285 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. Important CVE-2024-53104 at SUSE CVE-2024-53104 at NVD SUSE bug 1234025 SUSE bug 1236783 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks. Important CVE-2024-53141 at SUSE CVE-2024-53141 at NVD SUSE bug 1234381 SUSE bug 1245778 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Moderate CVE-2024-53150 at SUSE CVE-2024-53150 at NVD SUSE bug 1234834 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. Moderate CVE-2024-53197 at SUSE CVE-2024-53197 at NVD SUSE bug 1235464 SUSE Liberty Linux 7 LTSS iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Moderate CVE-2024-53580 at SUSE CVE-2024-53580 at NVD SUSE bug 1234705 SUSE Liberty Linux 7 LTSS virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287. Important CVE-2024-53899 at SUSE CVE-2024-53899 at NVD SUSE bug 1233706 SUSE Liberty Linux 7 LTSS xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. Important CVE-2024-55549 at SUSE CVE-2024-55549 at NVD SUSE bug 1239637 SUSE Liberty Linux 7 LTSS A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information. Important CVE-2024-5564 at SUSE CVE-2024-5564 at NVD SUSE bug 1225771 SUSE Liberty Linux 7 LTSS libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Important CVE-2024-56171 at SUSE CVE-2024-56171 at NVD SUSE bug 1237363 SUSE Liberty Linux 7 LTSS Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5. Important CVE-2024-56326 at SUSE CVE-2024-56326 at NVD SUSE bug 1234809 SUSE Liberty Linux 7 LTSS GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. Important CVE-2024-56737 at SUSE CVE-2024-56737 at NVD SUSE bug 1234958 SUSE Liberty Linux 7 If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5688 at SUSE CVE-2024-5688 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5690 at SUSE CVE-2024-5690 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5691 at SUSE CVE-2024-5691 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5693 at SUSE CVE-2024-5693 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5696 at SUSE CVE-2024-5696 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5700 at SUSE CVE-2024-5700 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. Critical CVE-2024-5702 at SUSE CVE-2024-5702 at NVD SUSE bug 1226027 cpe:/o:suse:sll:7 SUSE Liberty Linux 7 LTSS An issue in the sqlc_add_distinct_node component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. Important CVE-2024-57656 at SUSE CVE-2024-57656 at NVD SUSE Liberty Linux 7 LTSS In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path(). Moderate CVE-2024-57823 at SUSE CVE-2024-57823 at NVD SUSE bug 1235673 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Reviewed by: Ricardo Ribalda <ribalda@chromium.org> Moderate CVE-2024-57980 at SUSE CVE-2024-57980 at NVD SUSE bug 1237911 SUSE Liberty Linux 7 LTSS A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. Moderate CVE-2024-5953 at SUSE CVE-2024-5953 at NVD SUSE bug 1226277 SUSE Liberty Linux 7 LTSS A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. Important CVE-2024-6345 at SUSE CVE-2024-6345 at NVD SUSE bug 1228105 SUSE Liberty Linux 7 LTSS Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. Important CVE-2024-7348 at SUSE CVE-2024-7348 at NVD SUSE bug 1229013 SUSE Liberty Linux 7 LTSS The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. Moderate CVE-2024-8445 at SUSE CVE-2024-8445 at NVD SUSE bug 1230210 SUSE Liberty Linux 7 LTSS A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration. Important CVE-2024-9050 at SUSE CVE-2024-9050 at NVD SUSE bug 1231331 SUSE bug 1232040 SUSE Liberty Linux 7 LTSS A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges. Important CVE-2024-9632 at SUSE CVE-2024-9632 at NVD SUSE bug 1231565 SUSE Liberty Linux 7 LTSS A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections. Important CVE-2025-0624 at SUSE CVE-2025-0624 at NVD SUSE bug 1236316 SUSE Liberty Linux 7 LTSS Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. Important CVE-2025-1094 at SUSE CVE-2025-1094 at NVD SUSE bug 1237093 SUSE Liberty Linux 7 LTSS A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts. Important CVE-2025-11561 at SUSE CVE-2025-11561 at NVD SUSE bug 1251827 SUSE Liberty Linux 7 LTSS When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents. Moderate CVE-2025-12084 at SUSE CVE-2025-12084 at NVD SUSE bug 1254997 SUSE Liberty Linux 7 LTSS A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect. Important CVE-2025-1244 at SUSE CVE-2025-1244 at NVD SUSE bug 1237091 SUSE Liberty Linux 7 LTSS A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. Important CVE-2025-13601 at SUSE CVE-2025-13601 at NVD SUSE bug 1254297 SUSE Liberty Linux 7 LTSS The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Moderate CVE-2025-15366 at SUSE CVE-2025-15366 at NVD SUSE bug 1257044 SUSE Liberty Linux 7 LTSS The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Moderate CVE-2025-15367 at SUSE CVE-2025-15367 at NVD SUSE bug 1257041 SUSE Liberty Linux 7 LTSS Incorrect behavior order for some Intel(R) Core(tm) Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access. Moderate CVE-2025-20012 at SUSE CVE-2025-20012 at NVD SUSE bug 1242006 SUSE bug 1243123 SUSE Liberty Linux 7 LTSS Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Core(tm) processors (10th Generation) may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2025-20623 at SUSE CVE-2025-20623 at NVD SUSE bug 1242006 SUSE bug 1243454 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-21587 at SUSE CVE-2025-21587 at NVD SUSE bug 1241274 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Moderate CVE-2025-21928 at SUSE CVE-2025-21928 at NVD SUSE bug 1240722 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free. Important CVE-2025-22004 at SUSE CVE-2025-22004 at NVD SUSE bug 1240835 SUSE bug 1241090 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later. Fix nfsd_proc_stat_init() to return the same type of pointer as svc_proc_register(), and fix up nfsd_net_init() to check that and fail the nfsd_net construction if it occurs. svc_proc_register() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsd_net construction codepath, so if this happens, return -ENOMEM. Moderate CVE-2025-22026 at SUSE CVE-2025-22026 at NVD SUSE bug 1241349 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Moderate CVE-2025-23150 at SUSE CVE-2025-23150 at NVD SUSE bug 1242513 SUSE Liberty Linux 7 LTSS Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core(tm) Ultra Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2025-24495 at SUSE CVE-2025-24495 at NVD SUSE bug 1242006 SUSE bug 1243123 SUSE Liberty Linux 7 LTSS In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash. Moderate CVE-2025-24528 at SUSE CVE-2025-24528 at NVD SUSE bug 1236619 SUSE Liberty Linux 7 LTSS numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. Important CVE-2025-24855 at SUSE CVE-2025-24855 at NVD SUSE bug 1239625 SUSE Liberty Linux 7 LTSS libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. Moderate CVE-2025-24928 at SUSE CVE-2025-24928 at NVD SUSE bug 1237370 SUSE Liberty Linux 7 LTSS A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. Important CVE-2025-26594 at SUSE CVE-2025-26594 at NVD SUSE bug 1237427 SUSE Liberty Linux 7 LTSS A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size. Moderate CVE-2025-26595 at SUSE CVE-2025-26595 at NVD SUSE bug 1237429 SUSE Liberty Linux 7 LTSS A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow. Moderate CVE-2025-26596 at SUSE CVE-2025-26596 at NVD SUSE bug 1237430 SUSE Liberty Linux 7 LTSS A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size. Moderate CVE-2025-26597 at SUSE CVE-2025-26597 at NVD SUSE bug 1237431 SUSE Liberty Linux 7 LTSS An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access. Moderate CVE-2025-26598 at SUSE CVE-2025-26598 at NVD SUSE bug 1237432 SUSE Liberty Linux 7 LTSS An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later. Moderate CVE-2025-26599 at SUSE CVE-2025-26599 at NVD SUSE bug 1237433 SUSE Liberty Linux 7 LTSS A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free. Important CVE-2025-26600 at SUSE CVE-2025-26600 at NVD SUSE bug 1237434 SUSE Liberty Linux 7 LTSS A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers. Important CVE-2025-26601 at SUSE CVE-2025-26601 at NVD SUSE bug 1237435 SUSE Liberty Linux 7 LTSS An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. Important CVE-2025-27363 at SUSE CVE-2025-27363 at NVD SUSE bug 1239465 SUSE Liberty Linux 7 LTSS A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. Important CVE-2025-2784 at SUSE CVE-2025-2784 at NVD SUSE bug 1240750 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2025-30691 at SUSE CVE-2025-30691 at NVD SUSE bug 1241275 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-30698 at SUSE CVE-2025-30698 at NVD SUSE bug 1241274 SUSE bug 1241276 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-30749 at SUSE CVE-2025-30749 at NVD SUSE bug 1246595 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-30754 at SUSE CVE-2025-30754 at NVD SUSE bug 1246595 SUSE bug 1246598 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-30761 at SUSE CVE-2025-30761 at NVD SUSE bug 1246580 SUSE bug 1246595 SUSE Liberty Linux 7 LTSS A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS). Important CVE-2025-32049 at SUSE CVE-2025-32049 at NVD SUSE bug 1240751 SUSE bug 1250562 SUSE Liberty Linux 7 LTSS In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters. Moderate CVE-2025-32414 at SUSE CVE-2025-32414 at NVD SUSE bug 1241551 SUSE Liberty Linux 7 LTSS In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Low CVE-2025-32415 at SUSE CVE-2025-32415 at NVD SUSE bug 1241453 SUSE Liberty Linux 7 LTSS Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines. Important CVE-2025-32462 at SUSE CVE-2025-32462 at NVD SUSE bug 1245274 SUSE Liberty Linux 7 LTSS A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server. Important CVE-2025-32906 at SUSE CVE-2025-32906 at NVD SUSE bug 1241263 SUSE bug 1250562 SUSE Liberty Linux 7 LTSS A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server. Important CVE-2025-32911 at SUSE CVE-2025-32911 at NVD SUSE bug 1241238 SUSE bug 1250562 SUSE Liberty Linux 7 LTSS A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function. Important CVE-2025-32913 at SUSE CVE-2025-32913 at NVD SUSE bug 1241162 SUSE Liberty Linux 7 LTSS A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. Important CVE-2025-32914 at SUSE CVE-2025-32914 at NVD SUSE bug 1241164 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdisc_peek_len() to verify the queue wasn't emptied. Important CVE-2025-37797 at SUSE CVE-2025-37797 at NVD SUSE bug 1242417 SUSE bug 1245793 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer. Moderate CVE-2025-37823 at SUSE CVE-2025-37823 at NVD SUSE bug 1242924 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek. Important CVE-2025-38000 at SUSE CVE-2025-38000 at NVD SUSE bug 1244277 SUSE bug 1245775 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Important CVE-2025-38079 at SUSE CVE-2025-38079 at NVD SUSE bug 1245217 SUSE bug 1245218 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe. Important CVE-2025-38177 at SUSE CVE-2025-38177 at NVD SUSE bug 1237312 SUSE bug 1245986 SUSE bug 1246356 SUSE bug 1247374 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the type of related variables. Moderate CVE-2025-38200 at SUSE CVE-2025-38200 at NVD SUSE bug 1246045 SUSE bug 1246046 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated. BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string. Moderate CVE-2025-38332 at SUSE CVE-2025-38332 at NVD SUSE bug 1246375 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free. The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent's parent may run into the issue too. The following reproducer demonstrates this use-after-free: tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch ensures that qdisc_tree_reduce_backlog always calls qlen_notify when the child qdisc is empty. This solves the problem because deletion of qdiscs always involves a call to qdisc_reset() and / or qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing the following qdisc_tree_reduce_backlog() to report to the parent. Note that this may call qlen_notify on passive classes multiple times. This is not a problem after the recent patch series that made all the classful qdiscs qlen_notify() handlers idempotent. Important CVE-2025-38350 at SUSE CVE-2025-38350 at NVD SUSE bug 1246781 SUSE bug 1247043 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. Important CVE-2025-38352 at SUSE CVE-2025-38352 at NVD SUSE bug 1246911 SUSE bug 1249205 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize(). Moderate CVE-2025-38415 at SUSE CVE-2025-38415 at NVD SUSE bug 1247147 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets clip_push() to vcc->push(), and the second call copies it to clip_vcc->old_push(). Later, when the socket is close()d, vcc_destroy_socket() passes NULL skb to clip_push(), which calls clip_vcc->old_push(), triggering the infinite recursion. Let's prevent the second ioctl(ATMARP_MKIP) by checking vcc->user_back, which is allocated by the first call as clip_vcc. Note also that we use lock_sock() to prevent racy calls. [0]: BUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000) Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191 Code: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e R10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0 Call Trace: <TASK> clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 ... clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c:183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391 __fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff31c98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090 </TASK> Modules linked in: Moderate CVE-2025-38459 at SUSE CVE-2025-38459 at NVD SUSE bug 1247119 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. Important CVE-2025-38477 at SUSE CVE-2025-38477 at NVD SUSE bug 1247314 SUSE bug 1247315 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Moderate CVE-2025-38556 at SUSE CVE-2025-38556 at NVD SUSE bug 1248296 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv(). Moderate CVE-2025-38718 at SUSE CVE-2025-38718 at NVD SUSE bug 1249161 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too. Moderate CVE-2025-38729 at SUSE CVE-2025-38729 at NVD SUSE bug 1249164 SUSE Liberty Linux 7 LTSS This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Moderate CVE-2025-39751 at SUSE CVE-2025-39751 at NVD SUSE bug 1249538 SUSE bug 1249539 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses. Moderate CVE-2025-39757 at SUSE CVE-2025-39757 at NVD SUSE bug 1249515 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor. Moderate CVE-2025-39760 at SUSE CVE-2025-39760 at NVD SUSE bug 1249598 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp. Moderate CVE-2025-39817 at SUSE CVE-2025-39817 at NVD SUSE bug 1249998 SUSE Liberty Linux 7 LTSS This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Important CVE-2025-39898 at SUSE CVE-2025-39898 at NVD SUSE bug 1247374 SUSE bug 1250742 SUSE bug 1250744 SUSE bug 1253291 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Open socket as a new client before the TFO socket completes 3WHS: 1. accept() 2. connect(AF_UNSPEC) 3. connect() to another destination As of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes it to TCP_CLOSE and makes connect() possible, which restarts timers. Since tcp_disconnect() forgot to clear tcp_sk(sk)->fastopen_rsk, the retransmit timer triggered the warning and the intended packet was not retransmitted. Let's call reqsk_fastopen_remove() in tcp_disconnect(). [0]: WARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Modules linked in: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Code: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 <0f> 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e RSP: 0018:ffffc900002f8d40 EFLAGS: 00010293 RAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017 RDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400 RBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8 R10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540 R13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0 FS: 0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0 Call Trace: <IRQ> tcp_write_timer (net/ipv4/tcp_timer.c:738) call_timer_fn (kernel/time/timer.c:1747) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372) timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135) tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035) __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1)) tmigr_handle_remote (kernel/time/timer_migration.c:1096) handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580) irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35)) </IRQ> Moderate CVE-2025-39955 at SUSE CVE-2025-39955 at NVD SUSE bug 1251804 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg(). Moderate CVE-2025-39971 at SUSE CVE-2025-39971 at NVD SUSE bug 1252052 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Moderate CVE-2025-39993 at SUSE CVE-2025-39993 at NVD SUSE bug 1252070 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/ Moderate CVE-2025-40248 at SUSE CVE-2025-40248 at NVD SUSE bug 1254864 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Moderate CVE-2025-40271 at SUSE CVE-2025-40271 at NVD SUSE bug 1255297 SUSE Liberty Linux 7 LTSS Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. Important CVE-2025-40778 at SUSE CVE-2025-40778 at NVD SUSE bug 1252379 SUSE Liberty Linux 7 LTSS FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c. Moderate CVE-2025-40907 at SUSE CVE-2025-40907 at NVD SUSE bug 1243326 SUSE Liberty Linux 7 LTSS setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue. Important CVE-2025-47273 at SUSE CVE-2025-47273 at NVD SUSE bug 1243313 SUSE Liberty Linux 7 LTSS Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo). Important CVE-2025-4802 at SUSE CVE-2025-4802 at NVD SUSE bug 1243317 SUSE bug 1243318 SUSE Liberty Linux 7 LTSS Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Important CVE-2025-48384 at SUSE CVE-2025-48384 at NVD SUSE bug 1245943 SUSE Liberty Linux 7 LTSS A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow. Important CVE-2025-48797 at SUSE CVE-2025-48797 at NVD SUSE bug 1243711 SUSE Liberty Linux 7 LTSS A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues. Important CVE-2025-48798 at SUSE CVE-2025-48798 at NVD SUSE bug 1243712 SUSE Liberty Linux 7 LTSS KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code. Important CVE-2025-49091 at SUSE CVE-2025-49091 at NVD SUSE bug 1244569 SUSE Liberty Linux 7 LTSS A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash. Important CVE-2025-49175 at SUSE CVE-2025-49175 at NVD SUSE bug 1244082 SUSE Liberty Linux 7 LTSS A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check. Important CVE-2025-49176 at SUSE CVE-2025-49176 at NVD SUSE bug 1244084 SUSE Liberty Linux 7 LTSS A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service. Moderate CVE-2025-49178 at SUSE CVE-2025-49178 at NVD SUSE bug 1244087 SUSE Liberty Linux 7 LTSS A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks. Important CVE-2025-49179 at SUSE CVE-2025-49179 at NVD SUSE bug 1244089 SUSE Liberty Linux 7 LTSS A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate. Important CVE-2025-49180 at SUSE CVE-2025-49180 at NVD SUSE bug 1244090 SUSE Liberty Linux 7 LTSS A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk. Important CVE-2025-4948 at SUSE CVE-2025-4948 at NVD SUSE bug 1243332 SUSE bug 1250562 SUSE Liberty Linux 7 LTSS A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. Important CVE-2025-49794 at SUSE CVE-2025-49794 at NVD SUSE bug 1244554 SUSE Liberty Linux 7 LTSS A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory. Important CVE-2025-49796 at SUSE CVE-2025-49796 at NVD SUSE bug 1244557 SUSE Liberty Linux 7 LTSS In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade. Important CVE-2025-49812 at SUSE CVE-2025-49812 at NVD SUSE bug 1246161 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-50059 at SUSE CVE-2025-50059 at NVD SUSE bug 1246575 SUSE bug 1246595 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-50106 at SUSE CVE-2025-50106 at NVD SUSE bug 1246584 SUSE bug 1246595 SUSE Liberty Linux 7 LTSS Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2025-5283 at SUSE CVE-2025-5283 at NVD SUSE bug 1243741 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2025-53057 at SUSE CVE-2025-53057 at NVD SUSE bug 1252414 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2025-53066 at SUSE CVE-2025-53066 at NVD SUSE bug 1252417 SUSE Liberty Linux 7 LTSS GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752. Important CVE-2025-5473 at SUSE CVE-2025-5473 at NVD SUSE bug 1244058 SUSE Liberty Linux 7 LTSS OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue. Important CVE-2025-58060 at SUSE CVE-2025-58060 at NVD SUSE bug 1249049 SUSE Liberty Linux 7 LTSS Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. Moderate CVE-2025-58098 at SUSE CVE-2025-58098 at NVD SUSE bug 1254512 SUSE Liberty Linux 7 LTSS A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. Important CVE-2025-5914 at SUSE CVE-2025-5914 at NVD SUSE bug 1244272 SUSE Liberty Linux 7 LTSS A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Important CVE-2025-6019 at SUSE CVE-2025-6019 at NVD SUSE bug 1243285 SUSE Liberty Linux 7 LTSS A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions. Important CVE-2025-6020 at SUSE CVE-2025-6020 at NVD SUSE bug 1244509 SUSE Liberty Linux 7 LTSS A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. Important CVE-2025-6021 at SUSE CVE-2025-6021 at NVD SUSE bug 1244580 SUSE Liberty Linux 7 LTSS A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded. Moderate CVE-2025-61662 at SUSE CVE-2025-61662 at NVD SUSE bug 1252933 SUSE Liberty Linux 7 LTSS A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service. Important CVE-2025-62229 at SUSE CVE-2025-62229 at NVD SUSE bug 1251958 SUSE Liberty Linux 7 LTSS A flaw was discovered in the X.Org X server's X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect. Important CVE-2025-62230 at SUSE CVE-2025-62230 at NVD SUSE bug 1251959 SUSE Liberty Linux 7 LTSS A flaw was identified in the X.Org X server's X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Important CVE-2025-62231 at SUSE CVE-2025-62231 at NVD SUSE bug 1251960 SUSE Liberty Linux 7 LTSS Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values. Important CVE-2025-62626 at SUSE CVE-2025-62626 at NVD SUSE Liberty Linux 7 LTSS LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha x 257 required by the simplified PNG API. This issue has been patched in version 1.6.51. Moderate CVE-2025-64720 at SUSE CVE-2025-64720 at NVD SUSE bug 1254159 SUSE Liberty Linux 7 LTSS LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51. Moderate CVE-2025-65018 at SUSE CVE-2025-65018 at NVD SUSE bug 1254160 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. Important CVE-2025-68285 at SUSE CVE-2025-68285 at NVD SUSE bug 1255401 SUSE bug 1255402 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout. Moderate CVE-2025-68349 at SUSE CVE-2025-68349 at NVD SUSE bug 1255544 SUSE Liberty Linux 7 LTSS There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Important CVE-2025-6965 at SUSE CVE-2025-6965 at NVD SUSE bug 1246597 SUSE Liberty Linux 7 LTSS Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Important CVE-2025-8714 at SUSE CVE-2025-8714 at NVD SUSE bug 1248122 SUSE Liberty Linux 7 LTSS A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020. Important CVE-2025-8941 at SUSE CVE-2025-8941 at NVD SUSE bug 1248073 SUSE Liberty Linux 7 LTSS Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. Important CVE-2025-9230 at SUSE CVE-2025-9230 at NVD SUSE bug 1250232 SUSE bug 1250410 SUSE Liberty Linux 7 LTSS The email module, specifically the "BytesGenerator" class, didn't properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator". Important CVE-2026-1299 at SUSE CVE-2026-1299 at NVD SUSE bug 1257181 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2026-21925 at SUSE CVE-2026-21925 at NVD SUSE bug 1257034 SUSE Liberty Linux 7 LTSS Unknown. Moderate CVE-2026-21933 at SUSE CVE-2026-21933 at NVD SUSE bug 1257037 SUSE Liberty Linux 7 LTSS Unknown. Important CVE-2026-21945 at SUSE CVE-2026-21945 at NVD SUSE bug 1257038 SUSE Liberty Linux 7 LTSS In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will describe the scenario that unearthed this issue for the curious. GangMin Kim <km.kim1503@gmail.com> managed to concot a scenario as follows: ROOT qdisc 1:0 (QFQ) ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s ── class 1:2 (weight=1, lmax=1514) teql GangMin sends a packet which is enqueued to 1:1 (netem). Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF. Important CVE-2026-23074 at SUSE CVE-2026-23074 at NVD SUSE bug 1257749 SUSE bug 1258051 SUSE Liberty Linux 7 LTSS pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2. Important CVE-2026-23490 at SUSE CVE-2026-23490 at NVD SUSE bug 1256902