CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Opensuse » Leap » 42.2 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-1000366 119 Exec Code Overflow 2017-06-19 2020-10-15
7.2
 None Local Low Not required Complete Complete Complete
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
2 CVE-2017-17806 787 Overflow 2017-12-20 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
3 CVE-2017-17805 20 DoS 2017-12-20 2018-10-31
7.2
 None Local Low Not required Complete Complete Complete
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
4 CVE-2017-16232 772 DoS 2019-03-21 2019-10-03
5.0
 None Remote Low Not required None None Partial
** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.
5 CVE-2017-14804 20 2018-03-01 2019-10-09
5.0
 None Remote Low Not required None Partial None
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
6 CVE-2017-14493 119 DoS Exec Code Overflow 2017-10-03 2018-03-04
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
7 CVE-2017-14491 787 DoS Exec Code Overflow 2017-10-04 2022-04-22
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
8 CVE-2017-13088 330 2017-10-17 2019-10-03
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
9 CVE-2017-13087 330 2017-10-17 2019-10-03
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
10 CVE-2017-13086 330 2017-10-17 2019-10-03
5.4
 None Local Network Medium Not required Partial Partial Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
11 CVE-2017-13084 330 2017-10-17 2019-10-03
5.4
 None Local Network Medium Not required Partial Partial Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
12 CVE-2017-13082 330 2017-10-17 2019-10-03
5.8
 None Local Network Low Not required Partial Partial Partial
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
13 CVE-2017-13081 330 2017-10-17 2019-10-03
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
14 CVE-2017-13080 330 2017-10-17 2020-11-10
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
15 CVE-2017-13079 330 2017-10-17 2019-10-03
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
16 CVE-2017-13078 330 2017-10-17 2019-10-03
2.9
 None Local Network Medium Not required None Partial None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
17 CVE-2017-13077 330 2017-10-17 2019-10-03
5.4
 None Local Network Medium Not required Partial Partial Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
18 CVE-2017-8932 682 2017-07-06 2019-10-03
4.3
 None Remote Medium Not required Partial None None
A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.
19 CVE-2017-6594 295 Bypass 2017-08-28 2021-08-12
5.0
 None Remote Low Not required None Partial None
The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.
20 CVE-2017-6542 119 Overflow 2017-03-27 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.
21 CVE-2017-5938 79 XSS 2017-03-15 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.
22 CVE-2017-5930 862 2017-03-20 2020-02-26
3.5
 None Remote Medium ??? None Partial None
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
23 CVE-2017-5753 203 2018-01-04 2021-11-23
4.7
 None Local Medium Not required Complete None None
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
24 CVE-2017-5337 119 Overflow 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
25 CVE-2017-5336 119 Overflow 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
26 CVE-2017-5335 125 DoS 2017-03-24 2018-10-30
5.0
 None Remote Low Not required None None Partial
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
27 CVE-2017-5334 415 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
28 CVE-2017-5333 190 DoS Exec Code Overflow 2019-11-04 2019-11-07
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.
29 CVE-2017-5332 119 DoS Exec Code Overflow 2019-11-04 2019-11-06
6.8
 None Remote Medium Not required Partial Partial Partial
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
30 CVE-2017-5331 190 DoS Exec Code Overflow 2019-11-04 2019-11-05
4.6
 None Local Low Not required Partial Partial Partial
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
31 CVE-2016-1000002 200 +Info 2019-11-05 2020-08-18
2.1
 None Local Low Not required Partial None None
gdm3 3.14.2 and possibly later has an information leak before screen lock
32 CVE-2016-10207 119 DoS Overflow 2017-02-28 2018-02-01
5.0
 None Remote Low Not required None None Partial
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.
33 CVE-2016-10070 125 DoS Overflow 2017-03-03 2020-11-16
4.3
 None Remote Medium Not required None None Partial
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
34 CVE-2016-10068 20 DoS 2017-03-02 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.
35 CVE-2016-10051 416 DoS 2017-03-23 2020-11-16
6.8
 None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
36 CVE-2016-10050 119 DoS Overflow 2017-03-23 2020-11-16
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
37 CVE-2016-9961 189 2017-06-06 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
game-music-emu before 0.6.1 mishandles unspecified integer values.
38 CVE-2016-9960 369 DoS 2017-06-06 2018-10-30
2.1
 None Local Low Not required None None Partial
game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).
39 CVE-2016-9959 125 2017-04-12 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
40 CVE-2016-9958 119 Overflow 2017-04-12 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.
41 CVE-2016-9957 119 Overflow 2017-04-12 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in game-music-emu before 0.6.1.
42 CVE-2016-9843 189 2017-05-23 2020-07-28
7.5
 None Remote Low Not required Partial Partial Partial
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
43 CVE-2016-9842 189 2017-05-23 2020-07-28
6.8
 None Remote Medium Not required Partial Partial Partial
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
44 CVE-2016-9841 189 2017-05-23 2020-07-28
7.5
 None Remote Low Not required Partial Partial Partial
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
45 CVE-2016-9840 189 2017-05-23 2020-07-28
6.8
 None Remote Medium Not required Partial Partial Partial
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
46 CVE-2016-9830 20 DoS 2017-03-01 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.
47 CVE-2016-9436 20 2017-01-20 2018-10-30
4.3
 None Remote Medium Not required None None Partial
parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag.
48 CVE-2016-9435 20 2017-01-20 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
49 CVE-2016-9398 617 DoS 2017-03-23 2021-02-22
5.0
 None Remote Low Not required None None Partial
The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
50 CVE-2016-9106 772 DoS 2016-12-09 2020-10-15
2.1
 None Local Low Not required None None Partial
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
Total number of vulnerabilities : 86   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.