CVSS: 7.8EPSS: 3%CPEs: 20EXPL: 1CVE-2014-3687 – kernel: net: sctp: fix panic on duplicate ASCONF chunks
https://notcve.org/view.php?id=CVE-2014-3687
The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. La función sctp_assoc_lookup_asconf_ack en net/sctp/associola.c en la implementación SCTP en el kernel de Linux hasta 3.17.2 permite a atacantes remotos causar una denegación de servicio (kernel panic) a través de trozos ASCONF duplicados que provocan una liberación incorrecta dentro del intérprete de efectos secundarios. A flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69040d8e39f20d5215a03502a8e8b4c6ab78395 http://linux.oracle.com/errata/ELSA-2014-3087.html http://linux.oracle.com/errata/ELSA-2014-3088.html http://linux.oracle.com/errata/ELSA-2014-3089.html http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 1CVE-2014-1505 – Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28)
https://notcve.org/view.php?id=CVE-2014-1505
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. La implementación del filtro SVG en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird anterior a 24.4 y SeaMonkey anterior a 2.25 permite a atacantes remotos obtener información sensible de correlación de desplazamiento, y posiblemente evadir Same Origin Policy y leer texto de un dominio diferente, a través de ataques de tiempos involucrando elementos feDisplacementMap, un problema relacionado con CVE-2013-1693. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html http://rhn.redhat.com/errata/RHSA-2014-0310.html http://rhn.redhat.com/errata/RHSA-2014-0316.html http://www.debian.org/security/2014/dsa-2881 http://www.debian.org/security/2014/dsa-2911 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2012-0426
https://notcve.org/view.php?id=CVE-2012-0426
Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory. Condición de carrera en sap_suse_cluster_connector anterior a la versión 1.0.0-0.8.1 en SUSE Linux Enterprise para SAP Applications 11 SP2 permite a usuarios locales generar un impacto no especificado a través de vectores relacionados con un directorio tmp/. • http://download.novell.com/Download?buildid=DshQViDsMLE~ https://bugzilla.novell.com/show_bug.cgi?id=763793 https://bugzilla.novell.com/show_bug.cgi?id=777453 https://bugzilla.novell.com/show_bug.cgi?id=778273 https://bugzilla.novell.com/show_bug.cgi? • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 2%CPEs: 2EXPL: 0CVE-2012-0414
https://notcve.org/view.php?id=CVE-2012-0414
Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name. Vulnerabilidad de XSS en el servicio Spacewalk de SUSE Manager 1.2 para SUSE Linux Enterprise (SLE) 11 SP1 permite a atacantes remotos inyectar script web o HTML arbitrario a través de un nombre de imagen. • http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5145796.html https://bugzilla.novell.com/show_bug.cgi?id=761165 https://support.novell.com/security/cve/CVE-2012-0414.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 44EXPL: 2CVE-2013-4589
https://notcve.org/view.php?id=CVE-2013-4589
The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image. La función ExportAlphaQuantumType en export.c de GraphicsMagick anterior a la versión 1.3.18 podría permitir a atacantes remotos provocar una denegación de servicio (caída) a través de vectores relacionados con la exportación de alpha de una imagen RGBA de 8-bit. • http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120008.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00032.html http://secunia.com/advisories/55288 http://secunia.com/advisories/55721 http://security.gentoo.org/glsa/glsa-201311-10.xml http://sourceforge.net/p/graphicsmagick/code/ci/1a2d7a38363f7f23b63d626887d22d39c7240144 http://sourceforge.net/p/graphicsmagick/discussion/250737/thread/20888e8b http://www.openwall.com/lists/oss-security/2013/11/15/14 http:&#x •