Opensuse Project
54 CVEs across 9 Opensuse Project products. Browse Opensuse Project vulnerabilities, severities, and proof-of-concept exploits.
Opensuse Project products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17806 | High | 7.8 | 2017-12-20 | The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowi… |
CVE-2017-17805 | High | 7.8 | 2017-12-20 | The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_A… |
CVE-2016-1254 | High | 7.5 | 2017-12-05 | Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor. |
CVE-2015-3138 | High | 7.5 | 2017-09-28 | print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash). |
CVE-2014-4616 | Medium | 5.9 | 2017-08-24 | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to re… |
CVE-2015-3405 | High | 7.5 | 2017-08-09 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest… |
CVE-2015-5203 | Medium | 5.5 | 2017-08-02 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted… |
CVE-2015-5221 | Medium | 5.5 | 2017-07-25 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers… |
CVE-2016-9961 | Critical | 9.8 | 2017-06-06 | game-music-emu before 0.6.1 mishandles unspecified integer values. |
CVE-2016-9960 | Medium | 5.5 | 2017-06-06 | game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). |
CVE-2016-9959 | High | 7.8 | 2017-04-12 | game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values. |
CVE-2016-9958 | High | 7.8 | 2017-04-12 | game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations. |
CVE-2016-9957 | High | 7.8 | 2017-04-12 | Stack-based buffer overflow in game-music-emu before 0.6.1. |
CVE-2017-6542 | Critical | 9.8 | 2017-03-27 | The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol messa… |
CVE-2015-8010 | Medium | 6.1 | 2017-03-27 | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inj… |
CVE-2016-7797 | High | 7.5 | 2017-03-24 | Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated con… |
CVE-2016-9556 | Medium | 5.5 | 2017-03-23 | The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) v… |
CVE-2016-10048 | High | 7.5 | 2017-03-23 | Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors. |
CVE-2014-9851 | High | 7.5 | 2017-03-20 | ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash). |
CVE-2014-9850 | High | 7.5 | 2017-03-20 | Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption). |
CVE-2014-9849 | High | 7.5 | 2017-03-20 | The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). |
CVE-2014-9848 | High | 7.5 | 2017-03-20 | Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption). |
CVE-2014-9847 | Critical | 9.8 | 2017-03-20 | The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact. |
CVE-2014-9846 | Critical | 9.8 | 2017-03-20 | Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact. |
CVE-2014-9845 | Medium | 5.5 | 2017-03-20 | The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file. |
CVE-2014-9844 | Medium | 5.5 | 2017-03-20 | The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image… |
CVE-2014-9843 | Critical | 9.8 | 2017-03-20 | The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2014-9842 | High | 7.5 | 2017-03-20 | Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2014-9841 | Critical | 9.8 | 2017-03-20 | The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing… |
CVE-2014-9853 | Medium | 5.5 | 2017-03-17 | Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file. |
CVE-2017-5938 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to i… |
CVE-2016-10069 | Medium | 5.5 | 2017-03-02 | coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of fr… |
CVE-2016-10068 | Medium | 5.5 | 2017-03-02 | The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted… |
CVE-2016-9436 | Medium | 6.5 | 2017-01-20 | parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file… |
CVE-2016-9435 | Medium | 6.5 | 2017-01-20 | The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application… |
CVE-2016-5317 | Medium | 6.5 | 2017-01-20 | Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows att… |
CVE-2016-5316 | Medium | 6.5 | 2017-01-20 | Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a… |
CVE-2015-5218 | | 2015-11-09 | Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related… | |
CVE-2014-0481 | | 2014-08-26 | The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate… | |
CVE-2014-4258 | | 2014-07-17 | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect c… | |
CVE-2014-3004 | | 2014-06-11 | The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via… | |
CVE-2014-1542 | | 2014-06-11 | Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors… | |
CVE-2014-1528 | | 2014-04-30 | The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute… | |
CVE-2014-1502 | | 2014-03-19 | The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attack… | |
CVE-2014-1500 | | 2014-03-19 | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbef… | |
CVE-2014-1499 | | 2014-03-19 | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission pro… | |
CVE-2014-1498 | | 2014-03-19 | The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remo… | |
CVE-2014-1494 | | 2014-03-19 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of… | |
CVE-2014-0081 | | 2014-02-20 | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3… | |
CVE-2011-4093 | | 2014-02-10 | Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by… | |
CVE-2014-1489 | | 2014-02-06 | Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to ca… | |
CVE-2014-1484 | | 2014-02-06 | Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive informat… | |
CVE-2013-5611 | | 2013-12-11 | Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App ins… | |
CVE-2012-0867 | | 2012-07-18 | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, whi… |