11 SP4 * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2018-19543	125		2018-11-26	2020-09-25	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.
2	CVE-2018-19542	476	DoS	2018-11-26	2020-04-15	4.3	None	Remote	Medium	Not required	None	None	Partial
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.
3	CVE-2018-19541	125		2018-11-26	2021-01-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
4	CVE-2018-19540	787	Overflow	2018-11-26	2021-01-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.
5	CVE-2018-19539	617	DoS	2018-11-26	2020-08-24	4.3	None	Remote	Medium	Not required	None	None	Partial
An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.
6	CVE-2018-18873	476		2018-10-31	2020-09-25	4.3	None	Remote	Medium	Not required	None	None	Partial
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.
7	CVE-2018-17962	119	Overflow	2018-10-09	2020-08-24	5.0	None	Remote	Low	Not required	None	None	Partial
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
8	CVE-2018-10195	190	+Info	2021-06-02	2022-02-21	3.6	None	Local	Low	Not required	Partial	None	Partial
lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.
9	CVE-2017-1000366	119	Exec Code Overflow	2017-06-19	2020-10-15	7.2	None	Local	Low	Not required	Complete	Complete	Complete
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.
10	CVE-2017-18017	416	DoS Mem. Corr.	2018-01-03	2023-01-19	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
11	CVE-2017-17806	787	Overflow	2017-12-20	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
12	CVE-2017-17805	20	DoS	2017-12-20	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
13	CVE-2017-17558	787	DoS	2017-12-12	2019-05-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
14	CVE-2017-15115	416	DoS	2017-11-15	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
15	CVE-2017-14491	787	DoS Exec Code Overflow	2017-10-04	2022-04-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
16	CVE-2017-13088	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
17	CVE-2017-13087	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
18	CVE-2017-13086	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
19	CVE-2017-13084	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
20	CVE-2017-13082	330		2017-10-17	2019-10-03	5.8	None	Local Network	Low	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
21	CVE-2017-13081	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
22	CVE-2017-13080	330		2017-10-17	2020-11-10	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
23	CVE-2017-13079	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
24	CVE-2017-13078	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
25	CVE-2017-13077	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
26	CVE-2016-1000030	295	Exec Code	2018-09-05	2018-11-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
27	CVE-2016-5772	415	DoS Exec Code	2016-08-07	2022-07-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.
28	CVE-2016-5244	200	+Info	2016-06-27	2019-04-22	5.0	None	Remote	Low	Not required	Partial	None	None
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
29	CVE-2016-4957	476	DoS	2016-07-05	2020-06-18	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
30	CVE-2016-4956		DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.
31	CVE-2016-4955	362	DoS	2016-07-05	2021-07-16	4.3	None	Remote	Medium	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.
32	CVE-2016-4954	362	DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
33	CVE-2016-4953	287	DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.
34	CVE-2016-2782	476	DoS	2016-04-27	2022-01-31	4.9	None	Local	Low	Not required	None	None	Complete
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
35	CVE-2016-0718	119	DoS Exec Code Overflow	2016-05-26	2023-02-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
36	CVE-2016-0651			2016-04-21	2022-08-29	3.5	None	Remote	Medium	???	None	None	Partial
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
37	CVE-2016-0642			2016-04-21	2022-08-29	4.3	None	Remote	Medium	???	None	Partial	Partial
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.
38	CVE-2016-0264	119	Exec Code Overflow	2016-05-24	2021-09-09	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.
39	CVE-2015-8779	119	DoS Exec Code Overflow	2016-04-19	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.
40	CVE-2015-8778	119	DoS Exec Code Overflow	2016-04-19	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.
41	CVE-2015-8776	189	DoS +Info	2016-04-19	2018-10-30	6.4	None	Remote	Low	Not required	Partial	None	Partial
The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.
42	CVE-2015-8567	401	DoS	2017-04-13	2020-09-09	6.8	None	Remote	Low	???	None	None	Complete
Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
43	CVE-2015-8551	476	DoS	2016-04-13	2020-08-26	4.7	None	Local	Medium	Not required	None	None	Complete
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."
44	CVE-2015-7976	254		2017-01-30	2018-10-30	4.0	None	Remote	Low	???	None	Partial	None
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
45	CVE-2015-5300	361	DoS	2017-07-21	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
46	CVE-2015-5239	835	DoS Overflow	2020-01-23	2022-06-05	4.0	None	Remote	Low	???	None	None	Partial
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
47	CVE-2015-5154	119	Exec Code Overflow	2015-08-12	2023-02-13	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
48	CVE-2015-5041	200	+Info	2016-06-06	2019-06-19	6.4	None	Remote	Low	Not required	Partial	Partial	None
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
49	CVE-2015-5006	200	+Info	2015-12-07	2019-06-19	2.1	None	Local	Low	Not required	Partial	None	None
IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15, and 6 before SR16 FP15 allow physically proximate attackers to obtain sensitive information by reading the Kerberos Credential Cache.
50	CVE-2015-2738	17		2015-07-06	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

Total number of vulnerabilities : 59 Page : 1 (This Page)2