Vulnerabilities > Debian > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-08-07 CVE-2016-5770 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.
network
low complexity
php opensuse debian CWE-190
critical
9.8
2016-08-07 CVE-2016-5116 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
network
low complexity
libgd opensuse debian CWE-119
critical
9.1
2016-07-22 CVE-2016-4610 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612.
network
low complexity
xmlsoft apple fedoraproject debian CWE-119
critical
9.8
2016-07-22 CVE-2016-4609 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.
network
low complexity
xmlsoft apple fedoraproject debian CWE-119
critical
9.8
2016-07-13 CVE-2016-5008 Improper Access Control vulnerability in multiple products
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
network
low complexity
redhat debian CWE-284
critical
9.8
2016-07-03 CVE-2016-3955 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.
network
low complexity
canonical linux debian CWE-119
critical
9.8
2016-06-10 CVE-2016-5118 The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
network
low complexity
graphicsmagick suse oracle opensuse canonical debian imagemagick
critical
9.8
2016-06-09 CVE-2016-0749 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
network
low complexity
opensuse debian redhat spice-project CWE-119
critical
9.8
2016-06-08 CVE-2016-5108 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
network
low complexity
debian videolan CWE-119
critical
9.8
2016-06-07 CVE-2015-7695 SQL Injection vulnerability in multiple products
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
network
low complexity
zend debian CWE-89
critical
9.8