CVSS: 4.3EPSS: 3%CPEs: 7EXPL: 0CVE-2015-7217
https://notcve.org/view.php?id=CVE-2015-7217
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image. La configuración gdk-pixbuf en Mozilla Firefox en versiones anteriores a 43.0 en plataformas Linux GNOME habilita incorrectamente el decodificador TGA, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica) a través de una imagen Truevision TGA manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html http://www.mozilla.org/security/announce/2015/mfsa2015-143.html http://www.securityfocus.com/bid/79278 http://www.securitytracker.com/id/103 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7496 – gdm: Crash when holding Escape in log screen
https://notcve.org/view.php?id=CVE-2015-7496
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key. GNOME Display Manager (gdm) en versiones anteriores a 3.18.2 permite a atacantes físicamente próximos eludir la pantalla de bloqueo manteniendo pulsada la tecla Escape. It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html http://www.openwall.com/lists/oss-security/2015/11/17/10 http://www.openwall.com/lists/oss-security/2015/11/17/8 https://access.redhat.com/errata/RHSA-2017:2128 https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news https://access.redhat.com/security/cve/CVE-2015-7496 https://bugzilla.redhat.com/show_bug.cgi?id=1283279 • CWE-264: Permissions, Privileges, and Access Controls CWE-364: Signal Handler Race Condition •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-2675 – rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url
https://notcve.org/view.php?id=CVE-2015-2675
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account. La implementación OAuth en librest en versiones anteriores a la 0.7.93 trunca incorrectamente el puntero devuelto por la función rest_proxy_call_get_url. Esto permite que atacantes remotos provocan una denegación de servicio (bloqueo de aplicación) mediante la aplicación del método EnsureCredentials de la interfaz org.gnome.OnlineAccounts.Account en un objeto que representa una cuenta de Flickr. It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the rest_proxy_call_get_url call. An attacker could use this flaw to crash an application using the librest library. • http://rhn.redhat.com/errata/RHSA-2015-2237.html http://www.openwall.com/lists/oss-security/2015/03/23/8 https://bugzilla.gnome.org/show_bug.cgi?id=742644 https://bugzilla.redhat.com/show_bug.cgi?id=1183982 https://bugzilla.redhat.com/show_bug.cgi?id=1199049 https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea03817acdad87fb2b338a86018329 https://access.redhat.com/security/cve/CVE-2015-2675 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-704: Incorrect Type Conversion or Cast •
CVSS: 6.8EPSS: 2%CPEs: 5EXPL: 0CVE-2015-7674
https://notcve.org/view.php?id=CVE-2015-7674
Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow. Desbordamiento de entero en la función pixops_scale_nearest en pixops/pixops.c en gdk-pixbuf en versiones anteriores a 2.32.1 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) y posiblemente ejecutar código arbitrario a través de un archivo de imagen GIF manipulado, lo que desencadena un desbordamiento de buffer basado en memoria dinámica. • http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.32/gdk-pixbuf-2.32.1.news http://lists.opensuse.org/opensuse-updates/2016-03/msg00124.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00006.html http://www.debian.org/security/2015/dsa-3378 http://www.openwall.com/lists/oss-security/2015/10/01/4 http://www.openwall.com/lists/oss-security/2015/10/01/7 http://www.openwall.com/lists/oss-security/2015/10/02/10 http://www.openwall.com/lists/o • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 2%CPEs: 2EXPL: 0CVE-2015-7673
https://notcve.org/view.php?id=CVE-2015-7673
io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file. io-tga.c in gdk-pixbuf en versiones anteriores a 2.32.0 utiliza la memoria dinámica tras su asignación fallida, lo que permite a atacantes remotos provocar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica y caída de la aplicación) y posiblemente ejecutar código arbitrario a través de un archivo Truevision TGA (TARGA) manipulado. • http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.32/gdk-pixbuf-2.32.0.news http://lists.opensuse.org/opensuse-updates/2016-03/msg00124.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00006.html http://www.debian.org/security/2015/dsa-3378 http://www.openwall.com/lists/oss-security/2015/10/01/3 http://www.openwall.com/lists/oss-security/2015/10/02/9 http://www.securityfocus.com/bid/76953 http://www.ubuntu.com/usn/USN-2767-1 https://gi • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •