Vulnerabilities > Opensuse

DATE CVE VULNERABILITY TITLE RISK
2016-05-23 CVE-2016-4578 Information Exposure vulnerability in multiple products
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
local
low complexity
linux canonical debian redhat opensuse CWE-200
5.5
5.5
2016-05-22 CVE-2016-4544 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
php opensuse fedoraproject debian CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4543 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
hp php fedoraproject opensuse CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4542 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
php opensuse fedoraproject CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4541 The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
network
low complexity
fedoraproject php opensuse
critical
 9.8
9.8
2016-05-22 CVE-2016-4540 The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
network
low complexity
fedoraproject opensuse php
critical
 9.8
9.8
2016-05-22 CVE-2016-4539 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.
network
low complexity
php opensuse fedoraproject CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4538 Improper Input Validation vulnerability in multiple products
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
network
low complexity
php fedoraproject opensuse CWE-20
critical
 9.8
9.8
2016-05-22 CVE-2016-4537 Improper Input Validation vulnerability in multiple products
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
network
low complexity
php opensuse fedoraproject CWE-20
critical
 9.8
9.8
2016-05-22 CVE-2016-4346 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
network
low complexity
php opensuse CWE-190
critical
 9.8
9.8