CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 0CVE-2014-7923 – ICU: regexp engine missing look-behind expression range check
https://notcve.org/view.php?id=CVE-2014-7923
The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression. El paquete Regular Expressions en International Components for Unicode (ICU) 52 anterior a la versión SVN 292944, como es usada en Google Chrome anterior a la versión 40.0.2214.91, permite a los atacantes remotos generar una Denegación de Servicio (corrupción de la memoria) o posiblemente tener otros impactos no especificados por medio de vectores relacionados con una expresión look-behind. • http://advisories.mageia.org/MGASA-2015-0047.html http://bugs.icu-project.org/trac/ticket/11370 http://googlechromereleases.blogspot.com/2015/01/stable-update.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html http://rhn.redhat.com/errata/RHSA-2015-0093.html http://secunia.com/advisories/62383 http://secunia.com/advisories/62575 http://secunia.com/advisories/62665 http://security.gentoo.org/glsa/glsa-201502-13.xml http://www.oracle.com/technetwork/t • CWE-17: DEPRECATED: Code CWE-122: Heap-based Buffer Overflow •
CVSS: 6.8EPSS: 7%CPEs: 6EXPL: 0CVE-2014-8158 – jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)
https://notcve.org/view.php?id=CVE-2014-8158
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. Múltiples desbordamientos de buffer basado en pila en jpc_qmfb.c en JasPer 1.900.1 y anteriores permiten a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen JPEG 2000 manipulada. An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. • http://advisories.mageia.org/MGASA-2015-0038.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00014.html http://rhn.redhat.com/errata/RHSA-2015-0074.html http://rhn.redhat.com/errata/RHSA-2015-0698.html http://secunia.com/advisories/62583 http://secunia.com/advisories/62615 http://secunia.com/advisories/62619 http://secunia.com/advisories/62765 http://www.debian.org/security/2015/dsa-3138 http://www.mandriva.com/security/advisories?name=MDVSA-2015:034 http:/&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 9%CPEs: 6EXPL: 0CVE-2014-8157 – jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)
https://notcve.org/view.php?id=CVE-2014-8157
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. Error de superación de límite (off-by-one) en la función jpc_dec_process_sot en JasPer 1.900.1 y anteriores permite a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen JPEG 2000 manipulada, lo que provoca un desbordamiento de buffer basado en memoria dinámica. An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. • http://advisories.mageia.org/MGASA-2015-0038.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00014.html http://rhn.redhat.com/errata/RHSA-2015-0074.html http://rhn.redhat.com/errata/RHSA-2015-0698.html http://secunia.com/advisories/62583 http://secunia.com/advisories/62615 http://secunia.com/advisories/62619 http://secunia.com/advisories/62765 http://www.debian.org/security/2015/dsa-3138 http://www.mandriva.com/security/advisories?name=MDVSA-2015:034 http:/&# • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 2.1EPSS: 0%CPEs: 62EXPL: 0CVE-2015-0418
https://notcve.org/view.php?id=CVE-2015-0418
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0377. Vulnerabilidad no especificada en el componente Oracle VM VirtualBox en Oracle Virtualization VirtualBox anterior a 3.2.26, 4.0.28, 4.1.36, y 4.2.28 permite a usuarios locales afectar la disponibilidad a través de vectores relacionados con Core, una vulnerabilidad diferente de CVE-2015-0377. • http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html http://secunia.com/advisories/62694 http://www.debian.org/security/2015/dsa-3143 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.securityfocus.com/bid/72194 https://exchange.xforce.ibmcloud.com/vulnerabilities/100182 https://security.gentoo.org/glsa/201612-27 •
CVSS: 3.2EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0427
https://notcve.org/view.php?id=CVE-2015-0427
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595. Vulnerabilidad no especificada en el componente Oracle VM VirtualBox en Oracle Virtualization VirtualBox anterior a 4.3.20 permite a usuarios locales afectar la integridad y la disponibilidad a través de vectores relacionados con el dispositivo de gráficos virtuales VMSVGA, una vulnerabilidad diferente a CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, y CVE-2014-6595. • http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.securityfocus.com/bid/72216 https://exchange.xforce.ibmcloud.com/vulnerabilities/100181 https://security.gentoo.org/glsa/201612-27 •