CVSS: 4.3EPSS: 3%CPEs: 7EXPL: 0CVE-2015-7217
https://notcve.org/view.php?id=CVE-2015-7217
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image. La configuración gdk-pixbuf en Mozilla Firefox en versiones anteriores a 43.0 en plataformas Linux GNOME habilita incorrectamente el decodificador TGA, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica) a través de una imagen Truevision TGA manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html http://www.mozilla.org/security/announce/2015/mfsa2015-143.html http://www.securityfocus.com/bid/79278 http://www.securitytracker.com/id/103 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7496 – gdm: Crash when holding Escape in log screen
https://notcve.org/view.php?id=CVE-2015-7496
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key. GNOME Display Manager (gdm) en versiones anteriores a 3.18.2 permite a atacantes físicamente próximos eludir la pantalla de bloqueo manteniendo pulsada la tecla Escape. It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html http://www.openwall.com/lists/oss-security/2015/11/17/10 http://www.openwall.com/lists/oss-security/2015/11/17/8 https://access.redhat.com/errata/RHSA-2017:2128 https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news https://access.redhat.com/security/cve/CVE-2015-7496 https://bugzilla.redhat.com/show_bug.cgi?id=1283279 • CWE-264: Permissions, Privileges, and Access Controls CWE-364: Signal Handler Race Condition •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2014-7300 – gnome-shell: lockscreen bypass with printscreen key
https://notcve.org/view.php?id=CVE-2014-7300
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer. GNOME Shell 3.14.x anterior a 3.14.1, cuando se utiliza la característica Screen Lock, no se limita el consumo de memoria para todas las peticiones activas PrtSc , lo que permite a atacantes cercanos físicamente ejecutar comandos arbitrarios en una estación de trabajo desatendida haciendo numerosas peticiones PrtSc y aprovechando un bloqueo temporal, y la disponibilidad de una shell resultante temporal, causada por Linux kernel OOM killer. It was found that the Gnome shell did not disable the Print Screen key when the screen was locked. This could allow an attacker with physical access to a system with a locked screen to crash the screen-locking application by creating a large amount of screenshots. • http://openwall.com/lists/oss-security/2014/09/29/17 http://rhn.redhat.com/errata/RHSA-2015-0535.html https://bugzilla.gnome.org/show_bug.cgi?id=737456 https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013 https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378 https://access.redhat.com/security/cve/CVE-2014-7300 https://bugzilla.redhat.com/show_bug.cgi?id=1147917 • CWE-305: Authentication Bypass by Primary Weakness CWE-399: Resource Management Errors •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 1CVE-2011-2198
https://notcve.org/view.php?id=CVE-2011-2198
The "insert-blank-characters" capability in caps.c in gnome-terminal (vte) before 0.28.1 allows remote authenticated users to cause a denial of service (CPU and memory consumption and crash) via a crafted file, as demonstrated by a file containing the string "\033[100000000000000000@". La capacidad de "insertar caracteres en blanco" en caps.c en gnome-terminal (vte) en versiones anteriores a 0.28.1 permite a usuarios autenticados remotos provocar una denegación de servicio (consumo de CPU y memoria y caída) a través de un archivo manipulado, según lo demostrado por un archivo que contiene la cadena "\033[100000000000000000@". • http://lists.opensuse.org/opensuse-updates/2012-08/msg00001.html http://www.openwall.com/lists/oss-security/2011/06/09/3 http://www.openwall.com/lists/oss-security/2011/06/13/10 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629688 https://bugzilla.gnome.org/show_bug.cgi?id=652124 https://bugzilla.redhat.com/show_bug.cgi?id=712148 https://git.gnome.org/browse/vte/commit/?h=vte-0-28&am • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 4.6EPSS: 0%CPEs: 46EXPL: 0CVE-2013-7220
https://notcve.org/view.php?id=CVE-2013-7220
js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search. js/ui/screenShield.js en GNOME Shell (también conocido como gnome-shell) anterior a 3.8 permite a atacantes físicamente próximos ejecutar comandos arbitrarios mediante el aprovechamiento de una estación de trabajo desatendida con el foco de teclado en el campo de búsqueda de Activities. • http://www.openwall.com/lists/oss-security/2013/12/27/4 http://www.openwall.com/lists/oss-security/2013/12/27/6 http://www.openwall.com/lists/oss-security/2013/12/27/8 https://bugzilla.gnome.org/show_bug.cgi?id=686740 https://bugzilla.redhat.com/show_bug.cgi?id=1030431 https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j •