Filtered by vendor Gnu
Subscribe
Total
989 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-14443 | 1 Gnu | 1 Libredwg | 2018-08-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| get_first_owned_object in dwg.c in GNU LibreDWG 0.5.1036 allows remote attackers to cause a denial of service (SEGV). | |||||
| CVE-2018-14524 | 1 Gnu | 1 Libredwg | 2018-08-20 | 4.3 MEDIUM | 6.5 MEDIUM |
| dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value after a free occurs. | |||||
| CVE-2014-6277 | 1 Gnu | 1 Bash | 2018-08-08 | 10.0 HIGH | N/A |
| GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. | |||||
| CVE-2017-15670 | 1 Gnu | 1 Glibc | 2018-06-19 | 7.5 HIGH | 9.8 CRITICAL |
| The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. | |||||
| CVE-2017-15804 | 1 Gnu | 1 Glibc | 2018-06-19 | 7.5 HIGH | 9.8 CRITICAL |
| The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator. | |||||
| CVE-2000-0974 | 1 Gnu | 1 Privacy Guard | 2018-05-02 | 7.5 HIGH | N/A |
| GnuPG (gpg) 1.0.3 does not properly check all signatures of a file containing multiple documents, which allows an attacker to modify contents of all documents but the first without detection. | |||||
| CVE-2000-1137 | 1 Gnu | 1 Ed | 2018-05-02 | 4.6 MEDIUM | N/A |
| GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack. | |||||
| CVE-2001-0522 | 1 Gnu | 1 Privacy Guard | 2018-05-02 | 7.5 HIGH | N/A |
| Format string vulnerability in Gnu Privacy Guard (aka GnuPG or gpg) 1.05 and earlier can allow an attacker to gain privileges via format strings in the original filename that is stored in an encrypted file. | |||||
| CVE-2003-0255 | 1 Gnu | 1 Privacy Guard | 2018-05-02 | 10.0 HIGH | N/A |
| The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path. | |||||
| CVE-2004-0256 | 1 Gnu | 1 Libtool | 2018-05-02 | 2.1 LOW | N/A |
| GNU libtool before 1.5.2, during compile time, allows local users to overwrite arbitrary files via a symlink attack on libtool directories in /tmp. | |||||
| CVE-2016-10713 | 1 Gnu | 1 Patch | 2018-04-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. | |||||
| CVE-2018-1000097 | 3 Canonical, Debian, Gnu | 3 Ubuntu Linux, Debian Linux, Sharutils | 2018-04-13 | 6.8 MEDIUM | 7.8 HIGH |
| Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function looks_like_c_code. Failure to perform checking of the buffer containing input line. that can result in Could lead to code execution. This attack appear to be exploitable via Victim have to run unshar command on a specially crafted file.. | |||||
| CVE-2017-11671 | 1 Gnu | 1 Gcc | 2018-04-11 | 2.1 LOW | 4.0 MEDIUM |
| Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation. | |||||
| CVE-2014-5044 | 1 Gnu | 1 Libgfortran | 2018-03-27 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation. | |||||
| CVE-2017-15267 | 1 Gnu | 1 Libextractor | 2018-02-03 | 5.0 MEDIUM | 7.5 HIGH |
| In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c. | |||||
| CVE-2017-15601 | 1 Gnu | 1 Libextractor | 2018-02-03 | 5.0 MEDIUM | 7.5 HIGH |
| In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt and stndup. | |||||
| CVE-2017-15922 | 1 Gnu | 1 Libextractor | 2018-02-03 | 4.3 MEDIUM | 5.5 MEDIUM |
| In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c. | |||||
| CVE-2017-15266 | 1 Gnu | 1 Libextractor | 2018-02-03 | 4.3 MEDIUM | 5.5 MEDIUM |
| In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate. | |||||
| CVE-2017-15600 | 1 Gnu | 1 Libextractor | 2018-02-03 | 5.0 MEDIUM | 7.5 HIGH |
| In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c. | |||||
| CVE-2017-1000455 | 1 Gnu | 1 Guixsd | 2018-01-30 | 2.1 LOW | 5.5 MEDIUM |
| GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store", violating a fundamental security assumption of GNU Guix. | |||||