GNU : Security Vulnerabilities (CVSS score >= 9)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-43413				2021-11-07	2021-11-09	9.0	None	Remote	Low	???	Complete	Complete	Complete
An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access.
2	CVE-2021-3466	120		Overflow	2021-03-25	2021-12-15	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.
3	CVE-2019-13638	78			2019-07-26	2019-08-16	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
4	CVE-2018-20969	78			2019-08-16	2019-09-05	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.
5	CVE-2017-16997	426		+Priv	2017-12-18	2020-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
6	CVE-2017-13090	119		Overflow	2017-10-27	2017-12-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
7	CVE-2017-13089	119		Overflow	2017-10-27	2017-12-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
8	CVE-2015-2806	119		Overflow	2015-04-10	2018-01-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
9	CVE-2015-0235	787		Exec Code Overflow	2015-01-28	2022-07-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
10	CVE-2014-9488	119		Overflow	2015-04-14	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.
11	CVE-2014-7187	119		DoS Overflow	2014-09-28	2018-10-09	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
12	CVE-2014-7186	119		DoS Overflow	2014-09-28	2018-10-09	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
13	CVE-2014-7169	78		Exec Code	2014-09-25	2021-11-17	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
14	CVE-2014-6278	78		Exec Code	2014-09-30	2021-11-17	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
15	CVE-2014-6277	78		DoS Exec Code	2014-09-27	2018-08-09	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
16	CVE-2014-6271	78		Exec Code	2014-09-24	2021-11-17	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
17	CVE-2014-4877	22		Exec Code Dir. Trav.	2014-10-29	2017-02-17	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
18	CVE-2012-0035			+Priv	2012-01-19	2018-12-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
19	CVE-2011-4862	120	1	Exec Code Overflow	2011-12-25	2021-02-09	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
20	CVE-2008-3916	119		Exec Code Overflow	2008-09-04	2018-10-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.
21	CVE-2008-1949	287		DoS	2008-05-21	2018-10-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
22	CVE-2008-1948	189		DoS Exec Code Overflow	2008-05-21	2018-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
23	CVE-2007-6109	119		DoS Overflow	2007-12-07	2018-10-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.
24	CVE-2007-2500			Exec Code Overflow Mem. Corr.	2007-05-04	2017-07-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
server/parser/sprite_definition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2 allows remote attackers to execute arbitrary code via a large number of SHOWFRAME elements within a DEFINESPRITE element, which triggers memory corruption and enables the attacker to call free with an arbitrary address, probably resultant from a buffer overflow.
25	CVE-2006-6235			Exec Code	2006-12-07	2018-10-17	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
26	CVE-2006-4181			Exec Code	2006-11-28	2017-07-20	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
27	CVE-2005-2541			+Priv	2005-08-10	2021-06-18	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
28	CVE-2004-1701			Exec Code Overflow	2004-08-09	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
29	CVE-2004-1170			Exec Code	2005-01-10	2018-10-19	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.
30	CVE-2004-0623			Exec Code	2004-12-06	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
31	CVE-2004-0603			Exec Code	2004-12-06	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary commands, a different vulnerability than CVE-1999-1332.
32	CVE-2004-0354			Exec Code	2004-11-23	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the ssl_error function in ssl.c.
33	CVE-2004-0353			Overflow +Priv	2004-11-23	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.
34	CVE-2003-0972			Exec Code Overflow	2003-12-15	2016-10-18	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.
35	CVE-2003-0255				2003-05-27	2018-05-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
36	CVE-2000-0947			Exec Code	2000-12-19	2017-10-10	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the CAUTH command.
37	CVE-2000-0803			+Priv	2000-12-19	2021-05-10	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
GNU Groff uses the current working directory to find a device description file, which allows a local user to gain additional privileges by including a malicious postpro directive in the description file, which is executed when another user runs groff.

Total number of vulnerabilities : 37 Page : 1 (This Page)