Vulnerabilities > Redhat > Enterprise Linux HPC Node > High

DATE CVE VULNERABILITY TITLE RISK
2015-02-08 CVE-2014-9661 Remote vulnerability in FreeType Versions Prior to 2.5.4
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
7.5
2015-02-08 CVE-2014-9660 NULL Pointer Dereference vulnerability in multiple products
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
7.5
2015-02-08 CVE-2014-9658 Out-of-bounds Read vulnerability in multiple products
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
7.5
2015-02-08 CVE-2014-9657 Out-of-bounds Read vulnerability in multiple products
The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
7.5
2014-12-25 CVE-2014-7300 Resource Management Errors vulnerability in multiple products
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
local
low complexity
gnome redhat CWE-399
7.2
2014-08-14 CVE-2014-4344 Null Pointer Dereference vulnerability in multiple products
The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
network
low complexity
debian redhat mit CWE-476
7.8
2014-08-14 CVE-2014-4343 Double Free vulnerability in multiple products
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.
network
high complexity
debian mit redhat CWE-415
7.6
2013-01-25 CVE-2012-5689 Improper Input Validation vulnerability in multiple products
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
7.1