Vulnerabilities > Debian > High

DATE CVE VULNERABILITY TITLE RISK
2016-06-27 CVE-2016-5829 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
local
low complexity
debian linux novell canonical CWE-119
7.8
2016-06-27 CVE-2016-5828 Improper Input Validation vulnerability in multiple products
The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.
local
low complexity
linux novell debian canonical CWE-20
7.8
2016-06-27 CVE-2016-1583 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
local
low complexity
linux novell canonical debian CWE-119
7.8
2016-06-27 CVE-2014-9904 The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
local
low complexity
linux debian novell
7.8
2016-06-16 CVE-2016-5300 Resource Management Errors vulnerability in multiple products
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.
7.5
2016-06-16 CVE-2016-3062 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
network
low complexity
libav ffmpeg debian opensuse CWE-119
8.8
2016-06-14 CVE-2016-5338 The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.
local
low complexity
qemu canonical debian
7.8
2016-06-13 CVE-2016-3698 Improper Access Control vulnerability in multiple products
libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
network
high complexity
redhat libndp debian canonical CWE-284
8.1
2016-06-13 CVE-2016-2831 Improper Access Control vulnerability in multiple products
Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service (UI outage), or conduct clickjacking or spoofing attacks, via a crafted web site.
network
low complexity
canonical mozilla debian opensuse CWE-284
8.8
2016-06-13 CVE-2016-2828 Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.
network
low complexity
canonical opensuse mozilla debian
8.8