GNU
Page 8 of 13 — GNU CVEs from a corpus of 1285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000383 | Medium | 5.5 | 2017-10-31 | GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may b… |
CVE-2017-15996 | High | 7.8 | 2017-10-29 | elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other… |
CVE-2017-15939 | Medium | 5.5 | 2017-10-27 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, whic… |
CVE-2017-15938 | High | 7.5 | 2017-10-27 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of… |
CVE-2017-13090 | High | 8.8 | 2017-10-27 | The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strto… |
CVE-2017-13089 | High | 8.8 | 2017-10-27 | The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19… |
CVE-2017-15922 | Medium | 5.5 | 2017-10-26 | In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c. |
CVE-2017-15804 | Critical | 9.8 | 2017-10-22 | The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operato… |
CVE-2017-15671 | Medium | 5.9 | 2017-10-20 | The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when proce… |
CVE-2017-15670 | Critical | 9.8 | 2017-10-20 | The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related… |
CVE-2017-15602 | High | 7.5 | 2017-10-18 | In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, lea… |
CVE-2017-15601 | High | 7.5 | 2017-10-18 | In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related to processiTXt… |
CVE-2017-15600 | High | 7.5 | 2017-10-18 | In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c. |
CVE-2011-5320 | Medium | 6.2 | 2017-10-18 | scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s. |
CVE-2017-15267 | High | 7.5 | 2017-10-11 | In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c. |
CVE-2017-15266 | Medium | 5.5 | 2017-10-11 | In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate. |
CVE-2017-15225 | Medium | 5.5 | 2017-10-10 | _bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attacke… |
CVE-2017-15025 | Medium | 5.5 | 2017-10-05 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-15024 | Medium | 5.5 | 2017-10-05 | find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers… |
CVE-2017-15023 | Medium | 5.5 | 2017-10-05 | read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate th… |
CVE-2017-15022 | Medium | 5.5 | 2017-10-05 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allow… |
CVE-2017-15021 | Medium | 5.5 | 2017-10-05 | bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to… |
CVE-2017-15020 | High | 7.8 | 2017-10-05 | dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to c… |
CVE-2017-14974 | Medium | 5.5 | 2017-10-02 | The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a… |
CVE-2017-14940 | Medium | 5.5 | 2017-09-30 | scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cau… |
CVE-2017-14939 | Medium | 5.5 | 2017-09-30 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, wh… |
CVE-2017-14938 | Medium | 5.5 | 2017-09-30 | _bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers t… |
CVE-2017-14934 | Medium | 5.5 | 2017-09-30 | process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-14933 | Medium | 5.5 | 2017-09-30 | read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to ca… |
CVE-2017-14932 | Medium | 5.5 | 2017-09-30 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-14930 | Medium | 5.5 | 2017-09-30 | Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attack… |
CVE-2017-14745 | High | 7.8 | 2017-09-26 | The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a s… |
CVE-2017-14729 | High | 7.8 | 2017-09-25 | The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT… |
CVE-2015-1865 | Medium | 5.1 | 2017-09-20 | fts.c in coreutils 8.4 allows local users to delete arbitrary files. |
CVE-2017-14529 | Medium | 5.5 | 2017-09-18 | The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName ve… |
CVE-2017-14482 | High | 8.8 | 2017-09-14 | GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML e… |
CVE-2017-14333 | High | 7.8 | 2017-09-12 | The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a… |
CVE-2017-12133 | Medium | 5.9 | 2017-09-07 | Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to… |
CVE-2017-14130 | Medium | 5.5 | 2017-09-04 | The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows rem… |
CVE-2017-14129 | Medium | 5.5 | 2017-09-04 | The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to… |
CVE-2017-14128 | Medium | 5.5 | 2017-09-04 | The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attacker… |
CVE-2017-14062 | Critical | 9.8 | 2017-08-31 | Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have un… |
CVE-2017-14061 | Critical | 9.8 | 2017-08-31 | Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified ot… |
CVE-2017-13757 | Medium | 5.5 | 2017-08-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attacke… |
CVE-2017-13734 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack. |
CVE-2017-13733 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13732 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13731 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack. |
CVE-2017-13730 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13729 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack. |
CVE-2017-13728 | High | 7.5 | 2017-08-29 | There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service a… |
CVE-2017-13716 | Medium | 5.5 | 2017-08-28 | The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excess… |
CVE-2016-0634 | High | 7.5 | 2017-08-28 | The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname… |
CVE-2014-9483 | High | 7.5 | 2017-08-28 | Emacs 24.4 allows remote attackers to bypass security restrictions. |
CVE-2017-13710 | High | 7.5 | 2017-08-27 | The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cau… |
CVE-2015-1395 | High | 7.5 | 2017-08-25 | Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with… |
CVE-2014-9637 | Medium | 5.5 | 2017-08-25 | GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file. |
CVE-2017-12836 | High | 7.5 | 2017-08-24 | CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted host… |
CVE-2017-12967 | Medium | 6.5 | 2017-08-19 | The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause… |
CVE-2017-12961 | High | 7.5 | 2017-08-18 | There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remo… |
CVE-2017-12960 | High | 7.5 | 2017-08-18 | There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to r… |
CVE-2017-12959 | High | 7.5 | 2017-08-18 | There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a… |
CVE-2017-12958 | High | 7.5 | 2017-08-18 | There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote den… |
CVE-2017-12799 | High | 7.8 | 2017-08-10 | The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or po… |
CVE-2016-4456 | High | 7.5 | 2017-08-08 | The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem. |
CVE-2017-12459 | High | 7.8 | 2017-08-04 | The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and ea… |
CVE-2017-12458 | High | 7.8 | 2017-08-04 | The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and e… |
CVE-2017-12457 | High | 7.8 | 2017-08-04 | The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12456 | High | 7.8 | 2017-08-04 | The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a cra… |
CVE-2017-12455 | High | 7.8 | 2017-08-04 | The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allow… |
CVE-2017-12454 | High | 7.8 | 2017-08-04 | The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12453 | High | 7.8 | 2017-08-04 | The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows… |
CVE-2017-12452 | High | 7.8 | 2017-08-04 | The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binuti… |
CVE-2017-12451 | High | 7.8 | 2017-08-04 | The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GN… |
CVE-2017-12450 | High | 7.8 | 2017-08-04 | The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, a… |
CVE-2017-12449 | High | 7.8 | 2017-08-04 | The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12448 | High | 7.8 | 2017-08-04 | The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows r… |
CVE-2017-12132 | Medium | 5.9 | 2017-08-01 | The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name s… |
CVE-2017-11671 | Medium | 4.0 | 2017-07-26 | Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before… |
CVE-2017-11113 | High | 7.5 | 2017-07-08 | In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack… |
CVE-2017-11112 | High | 7.5 | 2017-07-08 | In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service… |
CVE-2017-10792 | Medium | 6.5 | 2017-07-02 | There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the… |
CVE-2017-10791 | Medium | 6.5 | 2017-07-02 | There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library co… |
CVE-2017-10790 | High | 7.5 | 2017-07-02 | The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignmen… |
CVE-2017-10685 | Critical | 9.8 | 2017-06-29 | In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. |
CVE-2017-10684 | Critical | 9.8 | 2017-06-29 | In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. |
CVE-2015-5180 | High | 7.5 | 2017-06-27 | res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash). |
CVE-2017-9955 | Medium | 5.5 | 2017-06-26 | The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to… |
CVE-2017-9954 | Medium | 5.5 | 2017-06-26 | The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cau… |
CVE-2017-9778 | Medium | 5.5 | 2017-06-21 | GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GD… |
CVE-2017-1000366 | High | 7.8 | 2017-06-19 | glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting… |
CVE-2017-9756 | High | 7.8 | 2017-06-19 | The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and a… |
CVE-2017-9755 | High | 7.8 | 2017-06-19 | opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buf… |
CVE-2017-9754 | High | 7.8 | 2017-06-19 | The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a c… |
CVE-2017-9753 | High | 7.8 | 2017-06-19 | The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initia… |
CVE-2017-9752 | High | 7.8 | 2017-06-19 | bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of ser… |
CVE-2017-9751 | High | 7.8 | 2017-06-19 | opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and ap… |
CVE-2017-9750 | High | 7.8 | 2017-06-19 | opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer ove… |
CVE-2017-9749 | High | 7.8 | 2017-06-19 | The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or pos… |
CVE-2017-9748 | High | 7.8 | 2017-06-19 | The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote atta… |