Vulnerabilities > High

DATE CVE VULNERABILITY TITLE RISK
2017-08-10 CVE-2014-0145 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Qemu
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
local
low complexity
qemu CWE-119
7.8
2017-08-10 CVE-2014-0143 Integer Overflow or Wraparound vulnerability in multiple products
Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.
local
high complexity
redhat qemu CWE-190
7.0
2017-08-10 CVE-2017-3751 Unquoted Search Path or Element vulnerability in Lenovo Thinkpad Compact USB Keyboard Driver
An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0.
local
low complexity
lenovo CWE-428
7.8
2017-08-09 CVE-2017-9799 Unspecified vulnerability in Apache Storm
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user.
network
low complexity
apache
8.8
2017-08-09 CVE-2017-3752 Improper Input Validation vulnerability in multiple products
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches.
high complexity
ibm lenovo CWE-20
8.2
2017-08-09 CVE-2017-12756 Command Injection vulnerability in Extplorer
Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter.
network
low complexity
extplorer CWE-77
7.2
2017-08-09 CVE-2017-0750 Out-of-bounds Write vulnerability in Google Android
A elevation of privilege vulnerability in the Upstream Linux file system.
local
low complexity
google CWE-787
7.8
2017-08-09 CVE-2017-0749 Unspecified vulnerability in Google Android
A elevation of privilege vulnerability in the Upstream Linux linux kernel.
local
low complexity
google
7.8
2017-08-09 CVE-2017-0747 Unspecified vulnerability in Google Android
A elevation of privilege vulnerability in the Qualcomm proprietary component.
local
low complexity
google
7.8
2017-08-09 CVE-2017-0746 Unspecified vulnerability in Google Android
A elevation of privilege vulnerability in the Qualcomm ipa driver.
local
low complexity
google
7.8