Vulnerabilities > Opensuse > Leap > 15.1

DATE CVE VULNERABILITY TITLE RISK
2018-12-26 CVE-2018-19873 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
An issue was discovered in Qt before 5.11.3.
network
low complexity
qt opensuse debian canonical CWE-119
critical
 9.8
9.8
2018-12-20 CVE-2018-20126 Missing Release of Resource after Effective Lifetime vulnerability in multiple products
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.
local
low complexity
qemu canonical opensuse CWE-772
5.5
5.5
2018-12-14 CVE-2018-16874 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters).
network
high complexity
golang opensuse suse debian
8.1
8.1
2018-12-14 CVE-2018-16873 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly.
network
high complexity
golang opensuse suse debian
8.1
8.1
2018-11-07 CVE-2018-16845 nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file.
local
low complexity
f5 debian canonical opensuse apple
6.1
6.1
2018-11-07 CVE-2018-16843 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.
network
low complexity
f5 debian canonical opensuse apple
7.5
7.5
2018-11-07 CVE-2018-19052 Path Traversal vulnerability in multiple products
An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50.
network
low complexity
lighttpd suse opensuse debian CWE-22
7.5
7.5
2018-10-19 CVE-2018-18521 Divide By Zero vulnerability in multiple products
Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. 		5.5
5.5
2018-10-19 CVE-2018-18520 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. 		6.5
6.5
2018-10-15 CVE-2018-18310 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. 		5.5
5.5