GNU
Page 7 of 13 — GNU CVEs from a corpus of 1285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000876 | High | 7.8 | 2018-12-20 | binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that c… |
CVE-2018-20230 | High | 7.8 | 2018-12-19 | An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows att… |
CVE-2018-20002 | Medium | 5.5 | 2018-12-10 | The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memor… |
CVE-2018-19932 | Medium | 5.5 | 2018-12-07 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and… |
CVE-2018-19931 | High | 7.8 | 2018-12-07 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer ove… |
CVE-2018-19591 | High | 7.5 | 2018-12-04 | In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descript… |
CVE-2018-16868 | Medium | 5.6 | 2018-12-03 | A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker… |
CVE-2018-19217 | Medium | 6.5 | 2018-11-12 | In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the… |
CVE-2018-19211 | Medium | 5.5 | 2018-11-12 | In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proc… |
CVE-2018-18751 | Critical | 9.8 | 2018-10-29 | An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in… |
CVE-2018-18701 | Medium | 5.5 | 2018-10-29 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infin… |
CVE-2018-18700 | Medium | 5.5 | 2018-10-29 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infin… |
CVE-2018-18607 | Medium | 5.5 | 2018-10-23 | An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There… |
CVE-2018-18606 | Medium | 5.5 | 2018-10-23 | An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31… |
CVE-2018-18605 | Medium | 5.5 | 2018-10-23 | A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), a… |
CVE-2018-18484 | Medium | 5.5 | 2018-10-18 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provide… |
CVE-2018-18483 | High | 7.8 | 2018-10-18 | The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc calle… |
CVE-2018-18309 | Medium | 5.5 | 2018-10-15 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory address dereference wa… |
CVE-2018-17985 | Medium | 5.5 | 2018-10-04 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demang… |
CVE-2018-17942 | High | 8.8 | 2018-10-03 | The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0… |
CVE-2018-17794 | Medium | 6.5 | 2018-09-30 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from wh… |
CVE-2018-17360 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_get… |
CVE-2018-17359 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_z… |
CVE-2018-17358 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_… |
CVE-2018-16430 | High | 8.8 | 2018-09-04 | GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c. |
CVE-2018-10846 | Medium | 5.6 | 2018-08-22 | A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination… |
CVE-2018-10845 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-10844 | Medium | 5.9 | 2018-08-22 | It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct di… |
CVE-2018-1000654 | Medium | 5.5 | 2018-08-20 | GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the… |
CVE-2018-0618 | Medium | 5.4 | 2018-07-26 | Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2018-14524 | Medium | 6.5 | 2018-07-23 | dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value… |
CVE-2018-14471 | Medium | 6.5 | 2018-07-20 | dwg_obj_block_control_get_block_headers in dwg_api.c in GNU LibreDWG 0.5.1048 allows remote attackers to cause a denial of service (NULL pointer dereference an… |
CVE-2018-14443 | Medium | 6.5 | 2018-07-20 | get_first_owned_object in dwg.c in GNU LibreDWG 0.5.1036 allows remote attackers to cause a denial of service (SEGV). |
CVE-2018-14347 | Medium | 6.5 | 2018-07-17 | GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c). |
CVE-2018-14346 | High | 8.8 | 2018-07-17 | GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c). |
CVE-2018-13796 | Medium | 6.5 | 2018-07-12 | An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. |
CVE-2018-13033 | Medium | 5.5 | 2018-07-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive mem… |
CVE-2018-12934 | High | 7.5 | 2018-06-28 | remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This c… |
CVE-2018-12699 | Critical | 9.8 | 2018-06-23 | finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impac… |
CVE-2018-12698 | High | 7.5 | 2018-06-23 | demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) duri… |
CVE-2018-12697 | High | 7.5 | 2018-06-23 | A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distribut… |
CVE-2018-12641 | Medium | 5.5 | 2018-06-22 | An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-11237 | High | 7.8 | 2018-05-18 | An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer… |
CVE-2018-11236 | Critical | 9.8 | 2018-05-18 | stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could… |
CVE-2017-18269 | Critical | 9.8 | 2018-05-18 | An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through… |
CVE-2018-0494 | Medium | 6.5 | 2018-05-06 | GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. |
CVE-2018-10535 | Medium | 5.5 | 2018-04-29 | The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the o… |
CVE-2018-10534 | Medium | 5.5 | 2018-04-29 | The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2… |
CVE-2018-10373 | Medium | 6.5 | 2018-04-25 | concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a d… |
CVE-2018-10372 | Medium | 5.5 | 2018-04-25 | process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) vi… |
CVE-2018-9996 | Medium | 5.5 | 2018-04-10 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided… |
CVE-2018-1000156 | High | 7.8 | 2018-04-06 | GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can resul… |
CVE-2018-9138 | Medium | 5.5 | 2018-03-30 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-8945 | Medium | 5.5 | 2018-03-22 | The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attack… |
CVE-2018-1000097 | High | 7.8 | 2018-03-13 | Sharutils sharutils (unshar command) version 4.15.2 contains a Buffer Overflow vulnerability in Affected component on the file unshar.c at line 75, function lo… |
CVE-2014-5044 | Critical | 9.8 | 2018-03-07 | Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via v… |
CVE-2018-7643 | High | 7.8 | 2018-03-02 | The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash)… |
CVE-2018-7642 | Medium | 5.5 | 2018-03-02 | The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attacker… |
CVE-2018-7570 | Medium | 5.5 | 2018-02-28 | The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30… |
CVE-2018-7569 | Medium | 5.5 | 2018-02-28 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (i… |
CVE-2018-7568 | Medium | 5.5 | 2018-02-28 | The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to ca… |
CVE-2017-18201 | Critical | 9.8 | 2018-02-26 | An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c. |
CVE-2017-18199 | Medium | 6.5 | 2018-02-24 | realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file. |
CVE-2017-18198 | High | 8.8 | 2018-02-24 | print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly… |
CVE-2018-7208 | High | 7.8 | 2018-02-18 | In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not… |
CVE-2018-6952 | High | 7.5 | 2018-02-13 | A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. |
CVE-2018-6951 | High | 7.5 | 2018-02-13 | An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service i… |
CVE-2016-10713 | Medium | 5.5 | 2018-02-13 | An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. |
CVE-2018-6872 | Medium | 5.5 | 2018-02-09 | The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to… |
CVE-2018-6759 | Medium | 5.5 | 2018-02-06 | The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchec… |
CVE-2018-6551 | Critical | 9.8 | 2018-02-02 | The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly h… |
CVE-2018-6543 | High | 7.8 | 2018-02-02 | In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafte… |
CVE-2018-6485 | Critical | 9.8 | 2018-02-01 | An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause th… |
CVE-2017-1000409 | High | 7.0 | 2018-02-01 | A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many ve… |
CVE-2017-1000408 | High | 7.8 | 2018-02-01 | A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many vers… |
CVE-2018-1000001 | High | 7.8 | 2018-01-31 | In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffe… |
CVE-2018-6323 | High | 7.8 | 2018-01-26 | The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer… |
CVE-2018-5950 | Medium | 6.1 | 2018-01-23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-optio… |
CVE-2018-6003 | High | 7.5 | 2018-01-22 | An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stac… |
CVE-2017-18018 | High | 7.1 | 2018-01-04 | In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" opti… |
CVE-2017-1000455 | Medium | 5.5 | 2018-01-02 | GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store… |
CVE-2017-16997 | High | 7.8 | 2017-12-18 | elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE… |
CVE-2017-17531 | High | 8.8 | 2017-12-14 | gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17440 | Medium | 6.5 | 2017-12-06 | GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Track… |
CVE-2017-17426 | High | 8.1 | 2017-12-05 | The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object wh… |
CVE-2017-17126 | High | 7.8 | 2017-12-04 | The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application… |
CVE-2017-17125 | High | 7.8 | 2017-12-04 | nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_ver… |
CVE-2017-17124 | High | 7.8 | 2017-12-04 | The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not… |
CVE-2017-17123 | Medium | 5.5 | 2017-12-04 | The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remot… |
CVE-2017-17122 | High | 7.8 | 2017-12-04 | The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to caus… |
CVE-2017-17121 | High | 7.8 | 2017-12-04 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory acce… |
CVE-2017-17080 | Medium | 5.5 | 2017-11-30 | elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remo… |
CVE-2017-16879 | High | 7.8 | 2017-11-22 | Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application cr… |
CVE-2017-16832 | High | 7.8 | 2017-11-15 | The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validat… |
CVE-2017-16831 | High | 7.8 | 2017-11-15 | coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows rem… |
CVE-2017-16830 | High | 7.8 | 2017-11-15 | The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote att… |
CVE-2017-16829 | High | 7.8 | 2017-11-15 | The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1… |
CVE-2017-16828 | High | 7.8 | 2017-11-15 | The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffe… |
CVE-2017-16827 | High | 7.8 | 2017-11-15 | The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remot… |
CVE-2017-16826 | High | 7.8 | 2017-11-15 | The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote… |