CVSS: 8.1EPSS: 0%CPEs: 23EXPL: 0CVE-2017-5333 – icoutils: Integer overflow vulnerability in extract.c
https://notcve.org/view.php?id=CVE-2017-5333
16 Jan 2017 — Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file. Un desbordamiento de enteros en la función extract_group_icon_cursor_resource en el archivo b/wrestool/extract.c en icoutils versiones anteriores a la versión 0.31.1, permite a usuarios locales causar una denegación de servicio (bloqueo del proceso) o ejecutar código arbit... • http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 4.7EPSS: 0%CPEs: 16EXPL: 0CVE-2016-9811 – gstreamer: Out of bounds heap read in windows_icon_typefind
https://notcve.org/view.php?id=CVE-2016-9811
13 Jan 2017 — The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file. La función windows_icon_typefind en gst-plugins-base en GStreamer en versiones anteriores a 1.10.2, cuando G_SLICE esta configurado para malloc siempre, permite a atacantes remotos provocar una denegación de servicio (lectura fuera de los límites) a través de un archivo ico manipulado. GStrea... • http://www.debian.org/security/2017/dsa-3819 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 58%CPEs: 45EXPL: 0CVE-2016-9131 – bind: assertion failure while processing response to an ANY query
https://notcve.org/view.php?id=CVE-2016-9131
12 Jan 2017 — named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. named en ISC BIND 9.x en versiones anteriores a 9.9.9-P5, 9.10.x en versiones anteriores a 9.10.4-P5 y 9.11.x en versiones anteriores a 9.11.0-P2 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una respuesta mal for... • http://rhn.redhat.com/errata/RHSA-2017-0062.html • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 22EXPL: 0CVE-2016-9401 – bash: popd controlled free
https://notcve.org/view.php?id=CVE-2016-9401
02 Jan 2017 — popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. popd en bash podrían permitir a usuarios locales eludir el shell restringido y provocar un uso después de liberación de memoria a través de una dirección manipulada. A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of service limited to a specific bash session. The bash packages provi... • http://rhn.redhat.com/errata/RHSA-2017-0725.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 11%CPEs: 27EXPL: 0CVE-2016-8743 – httpd: Apache HTTP Request Parsing Whitespace Defects
https://notcve.org/view.php?id=CVE-2016-8743
25 Dec 2016 — Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. El servidor HTTP Apache, en todas las distribuciones... • http://rhn.redhat.com/errata/RHSA-2017-1415.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 33%CPEs: 92EXPL: 0CVE-2016-7426 – ntp: Client rate limiting and server responses
https://notcve.org/view.php?id=CVE-2016-7426
21 Dec 2016 — NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address. NTP en versiones anteriores a 4.2.8p9 limita la clasificación de respuestas recibidas desde las fuentes configuradas cuando la limitación de clasificación para todas las asociaciones está habilitado, lo que permite a atacantes remotos... • http://nwtime.org/ntp428p9_release • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 13%CPEs: 18EXPL: 0CVE-2016-2125 – samba: Unconditional privilege delegation to Kerberos servers in trusted realms
https://notcve.org/view.php?id=CVE-2016-2125
19 Dec 2016 — It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. Se ha descubierto que Samba, en versiones anteriores a la 4.5.3, 4.4.8 y 4.3.13, siempre solicitaba tickets que podían reenviarse al emplear la autenticación de Kerberos. Un servicio al que Samba se ha autenticado con Kerberos podría ... • http://rhn.redhat.com/errata/RHSA-2017-0494.html • CWE-20: Improper Input Validation CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 0CVE-2016-9893 – Mozilla: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 (MFSA 2016-95)
https://notcve.org/view.php?id=CVE-2016-9893
14 Dec 2016 — Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Se han reportado errores de seguridad de memoria en Thunderbird 45.5. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerzo, algunos de estos podrían ex... • http://rhn.redhat.com/errata/RHSA-2016-2946.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 1CVE-2016-9895 – Mozilla: CSP bypass using marquee tag (MFSA 2016-94, MFSA 2016-95)
https://notcve.org/view.php?id=CVE-2016-9895
14 Dec 2016 — Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Los gestores de eventos en los elementos "marquee" se ejecutaron a pesar de que existe un CSP (Content Security Policy) estricto que prohibía el JavaScript inline. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50.1, Firefox ESR en versiones anteriores a la 45.6 y Thunderbir... • http://rhn.redhat.com/errata/RHSA-2016-2946.html • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 1CVE-2016-9898 – Mozilla: Use-after-free in Editor while manipulating DOM subtrees (MFSA 2016-94, MFSA 2016-95)
https://notcve.org/view.php?id=CVE-2016-9898
14 Dec 2016 — Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Uso de memoria previamente liberada que resulta en un cierre inesperado potencialmente explotable al manipular subárboles DOM en el Editor. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50.1, Firefox ESR en versiones anteriores a la 45.6 y Thunderbird en versiones anteriores a la 45.6. Multiple memory ... • http://rhn.redhat.com/errata/RHSA-2016-2946.html • CWE-416: Use After Free •