CVSS: 9.3EPSS: 2%CPEs: 4EXPL: 0CVE-2016-0794 – libreoffice: Multiple out-of-bounds overflows in lwp filter
https://notcve.org/view.php?id=CVE-2016-0794
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document. El filtro lwp en LibreOffice en versiones anteriores a 5.0.4 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de un documento LotusWordPro (lwp) manipulado. Multiple flaws were found in the Lotus Word Pro (LWP) document format parser in LibreOffice. By tricking a user into opening a specially crafted LWP document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178036.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00110.html http://lists.opensuse.org/opensuse-updates/2016-07/msg00050.html http://rhn.redhat.com/errata/RHSA-2016-2579.html http://www.debian.org/security/2016/dsa-3482 http://www.securitytracker.com/id/1035022 http://www.ubuntu.com/usn/USN-2899-1 https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794 https://www.verisign.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 2%CPEs: 4EXPL: 0CVE-2016-0795 – libreoffice: Multiple out-of-bounds overflows in lwp filter
https://notcve.org/view.php?id=CVE-2016-0795
LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document. LibreOffice en versiones anteriores a 5.0.5 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de un registro LwpTocSuperLayout manipulado en un documento LotusWordPro (lwp). Multiple flaws were found in the Lotus Word Pro (LWP) document format parser in LibreOffice. By tricking a user into opening a specially crafted LWP document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178036.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00110.html http://lists.opensuse.org/opensuse-updates/2016-07/msg00050.html http://rhn.redhat.com/errata/RHSA-2016-2579.html http://www.debian.org/security/2016/dsa-3482 http://www.securitytracker.com/id/1035022 http://www.ubuntu.com/usn/USN-2899-1 https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795 https://www.verisign.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 97%CPEs: 68EXPL: 10CVE-2015-7547 – glibc - 'getaddrinfo' Stack Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2015-7547
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module. Múltiples desbordamientos de buffer basado en pila en las funciones (1) send_dg y (2) send_vc en la librería libresolv en la librería GNU C (también conocida como glibc o libc6) en versiones anteriores a 2.23 permiten a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una respuesta DNS manipulada que desencadenan una llamada a la función getaddrinfo con la familia de direcciones AF_UNSPEC o AF_INET6, en relación con la ejecución de "consultas duales A/AAAA DNS" y el módulo libnss_dns.so.2 NSS. A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module. • https://www.exploit-db.com/exploits/39454 https://www.exploit-db.com/exploits/40339 https://github.com/fjserna/CVE-2015-7547 https://github.com/cakuzo/CVE-2015-7547 https://github.com/Stick-U235/CVE-2015-7547-Research https://github.com/t0r0t0r0/CVE-2015-7547 https://github.com/babykillerblack/CVE-2015-7547 https://github.com/Amilaperera12/Glibc-Vulnerability-Exploit-CVE-2015-7547 https://github.com/miracle03/CVE-2015-7547-master https://github.com/bluebluelan/CVE-2015-7547&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 6.5EPSS: 3%CPEs: 4EXPL: 0CVE-2013-7447
https://notcve.org/view.php?id=CVE-2013-7447
Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation. Desbordamiento de entero en la función gdk_cairo_set_source_pixbuf en gdk/gdkcairo.c en GTK+ en versiones anteriores a 3.9.8, tal como se utiliza en eom, gnome-photos, eog, gambas3, thunar, pinpoint y posiblemente otras aplicaciones, permite a atacantes remotos provocar una denegación de servicio (caída) a través de un archivo de imagen grande, lo que desencadena una gran asignación de memoria. • http://lists.opensuse.org/opensuse-updates/2016-03/msg00010.html http://www.openwall.com/lists/oss-security/2016/02/10/2 http://www.openwall.com/lists/oss-security/2016/02/10/6 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/83239 http://www.ubuntu.com/usn/USN-2898-1 http://www.ubuntu.com/usn/USN-2898-2 https://bugs.launchpad.net/ubuntu/+source/gtk+2.0/+bug/1540811 https://bugzilla.gnome.org&# •
CVSS: 2.0EPSS: 0%CPEs: 6EXPL: 0CVE-2015-7511
https://notcve.org/view.php?id=CVE-2015-7511
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations. Libgcrypt en versiones anteriores a 1.6.5 no lleva a cabo correctamente la multiplicación de curva de puntos elípticos durante el descifrado, lo que facilita a atacantes físicamente próximos extrarer claves ECDH mediante la lectura de las emanaciones electromagnéticas. • http://lists.opensuse.org/opensuse-updates/2016-05/msg00027.html http://www.cs.tau.ac.IL/~tromer/ecdh http://www.debian.org/security/2016/dsa-3474 http://www.debian.org/security/2016/dsa-3478 http://www.securityfocus.com/bid/83253 http://www.ubuntu.com/usn/USN-2896-1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2IL4PAEICHGA2XMQYRY3MIWHM4GMPAG https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html https://security.gentoo • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •