Vulnerabilities > 7PK - Security Features

DATE CVE VULNERABILITY TITLE RISK
2016-01-08 CVE-2015-8615 7PK - Security Features vulnerability in XEN 4.6.0
The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
network
low complexity
xen CWE-254
5.0
2016-01-08 CVE-2015-7554 7PK - Security Features vulnerability in Libtiff 4.0.6
The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.
network
low complexity
libtiff CWE-254
critical
9.8
2016-01-02 CVE-2015-7435 7PK - Security Features vulnerability in IBM Tivoli Common Reporting
IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application Firewall (CAF) protection mechanism via leading whitespace in the BackURL field.
local
high complexity
ibm CWE-254
2.5
2015-07-09 CVE-2015-1793 7PK - Security Features vulnerability in multiple products
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
network
low complexity
oracle openssl CWE-254
6.5
2011-06-30 CVE-2009-5078 7PK - Security Features vulnerability in multiple products
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.
network
low complexity
gnu apple CWE-254
6.5