CVSS: 5.5EPSS: 2%CPEs: 3EXPL: 0CVE-2016-9556
https://notcve.org/view.php?id=CVE-2016-9556
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file. La función IsPixelGray en MagickCore/pixel-accessor.h en ImageMagick 7.0.3-8 permite a atacantes remotos provocar una denegación de servicio (lectura de memoria dinámica fuera de límites) a través de un archivo de imagen manipulado. • http://lists.opensuse.org/opensuse-updates/2016-12/msg00040.html http://www.debian.org/security/2016/dsa-3726 http://www.openwall.com/lists/oss-security/2016/11/23/1 http://www.openwall.com/lists/oss-security/2016/12/01/4 http://www.openwall.com/lists/oss-security/2016/12/02/12 http://www.securityfocus.com/bid/94492 https://blogs.gentoo.org/ago/2016/11/19/imagemagick-heap-based-buffer-overflow-in-ispixelgray-pixel-accessor-h https://bugzilla.redhat.com/show_bug • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.6EPSS: 2%CPEs: 7EXPL: 0CVE-2016-7797 – pacemaker: pacemaker remote nodes vulnerable to hijacking, resulting in a DoS attack
https://notcve.org/view.php?id=CVE-2016-7797
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection. Pacemaker en versiones anteriores a 1.1.15, al usar el control remoto de marcapasos, podría permitir a atacantes remotos provocar una denegación de servicio (desconexión de nodo) a través de una conexión no autenticada. It was found that the connection between a pacemaker cluster and a pacemaker_remote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to cause a denial of service. • http://bugs.clusterlabs.org/show_bug.cgi?id=5269 http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00001.html http://lists.opensuse.org/opensuse-updates/2016-12/msg00077.html http://rhn.redhat.com/errata/RHSA-2016-2578.html http://www.openwall.com/lists/oss-security/2016/10/01/1 http://www.securityfocus.com/bid/93261 https://github.com/ClusterLabs/pacemaker/commit/5ec24a2642bd0854b884d1a9b51d12371373b410 htt • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-5178 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5178
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 53.0.2785.143 permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos • http://lists.opensuse.org/opensuse-updates/2016-10/msg00000.html http://lists.opensuse.org/opensuse-updates/2016-10/msg00001.html http://rhn.redhat.com/errata/RHSA-2016-2007.html http://www.debian.org/security/2016/dsa-3683 http://www.securityfocus.com/bid/93238 http://www.securitytracker.com/id/1036970 https://bugs.chromium.org/p/chromium/issues/detail?id=645028 https://bugs.chromium.org/p/chromium/issues/detail?id=651092 https://bugzilla.redhat.com/show_bug.cgi?id=1380632 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2016-5177 – chromium-browser: use after free in v8
https://notcve.org/view.php?id=CVE-2016-5177
Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors. Vulnerabilidad de uso después de linberación en V8 en Google Chrome anterior a la versión 53.0.2785.143, permite a atacantes remotos provocar una denegación de servicio (bloqueo) o posiblemente tener otro impacto no especificado a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-updates/2016-10/msg00000.html http://lists.opensuse.org/opensuse-updates/2016-10/msg00001.html http://rhn.redhat.com/errata/RHSA-2016-2007.html http://www.debian.org/security/2016/dsa-3683 http://www.securityfocus.com/bid/93238 http://www.securitytracker.com/id/1036970 https://bugzilla.redhat.com/show_bug.cgi?id=1380631 https://chromereleases.googleblog.com/2016/09/stable-channel-update-for-desktop_29.html https://lists.fedoraproject.org/archives/ • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-7141 – curl: Incorrect reuse of client certificates
https://notcve.org/view.php?id=CVE-2016-7141
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. curl y libcurl en versiones anteriores a 7.50.2, cuando se construye con NSS y la librería libnsspem.so está disponible en tiempo de ejecución, permiten a atacantes remotos secuestrar la autenticación de una conexión TLS aprovechando la reutilización de un certificado cliente cargado previamente desde un archivo para una conexión para el que no se ha configurado ningún certificado, una vulnerabilidad diferente a CVE-2016-5420. It was found that the libcurl library using the NSS (Network Security Services) library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. • http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html http://rhn.redhat.com/errata/RHSA-2016-2575.html http://rhn.redhat.com/errata/RHSA-2016-2957.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/92754 http://www.securitytracker.com/id/1036739 https://access.redhat.com/errata/RHSA-2018:3558 https://bugzilla.redhat.com/show_bug.cgi?id=1373229 https://curl.haxx.se/docs/adv_20160907.html https://githu • CWE-287: Improper Authentication CWE-295: Improper Certificate Validation •