Vulnerabilities > Fedoraproject > High

DATE CVE VULNERABILITY TITLE RISK
2016-02-13 CVE-2016-1522 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
network
low complexity
fedoraproject mozilla debian sil CWE-119
8.8
2016-02-13 CVE-2016-1521 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
network
low complexity
debian sil mozilla fedoraproject CWE-119
8.8
2016-01-22 CVE-2016-1572 Improper Privilege Management vulnerability in multiple products
mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid.
8.4
2016-01-13 CVE-2015-8466 Improper Input Validation vulnerability in multiple products
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
network
high complexity
fedoraproject openstack CWE-20
7.4
2016-01-12 CVE-2016-1232 The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
network
low complexity
prosody fedoraproject debian
7.5
2016-01-12 CVE-2015-8400 7PK - Security Features vulnerability in multiple products
The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
network
low complexity
fedoraproject shellinabox-project CWE-254
7.4
2016-01-12 CVE-2015-1779 Resource Exhaustion vulnerability in multiple products
The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
8.6
2016-01-11 CVE-2015-6566 Link Following vulnerability in multiple products
zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-*.
local
low complexity
zarafa fedoraproject CWE-59
8.4
2015-12-02 CVE-2015-8393 Information Exposure vulnerability in multiple products
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.
network
low complexity
pcre fedoraproject php CWE-200
7.5
2015-12-02 CVE-2015-8387 Integer Overflow or Wraparound vulnerability in multiple products
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject php CWE-190
7.3