11.4 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2015-3195	200		+Info	2015-12-06	2021-01-19	5.0	None	Remote	Low	Not required	None	None	Partial
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
2	CVE-2014-4943	269	1	+Priv	2014-07-19	2020-08-14	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
3	CVE-2014-4608	190		DoS Overflow Mem. Corr.	2014-07-03	2020-08-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is not affected; media hype."
4	CVE-2014-3153	269	1	+Priv	2014-06-07	2021-02-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
5	CVE-2014-2913			Exec Code	2014-05-07	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.
6	CVE-2014-2324	22		Dir. Trav.	2014-03-14	2021-02-24	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
7	CVE-2014-2323	89		Exec Code Sql	2014-03-14	2021-02-26	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
8	CVE-2014-2309	119		DoS Overflow	2014-03-11	2020-08-27	6.1	None	Local Network	Low	Not required	None	None	Complete
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.
9	CVE-2014-2030	787		DoS Exec Code Overflow	2020-02-06	2020-02-11	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.
10	CVE-2014-1958	120		Exec Code Overflow	2020-02-06	2020-02-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
11	CVE-2014-1532	416		DoS Exec Code Mem. Corr.	2014-04-30	2020-08-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
12	CVE-2014-1531	416		DoS Exec Code Mem. Corr.	2014-04-30	2020-08-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.
13	CVE-2014-1530	79		XSS	2014-04-30	2020-08-07	4.3	None	Remote	Medium	Not required	None	Partial	None
The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.
14	CVE-2014-1529	269		Exec Code Bypass	2014-04-30	2020-08-06	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.
15	CVE-2014-1524	120		DoS Exec Code Overflow	2014-04-30	2020-08-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.
16	CVE-2014-1523	787		DoS Overflow	2014-04-30	2020-08-07	4.3	None	Remote	Medium	Not required	None	None	Partial
Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.
17	CVE-2014-1518			DoS Exec Code Mem. Corr.	2014-04-30	2020-08-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
18	CVE-2014-1514	787		DoS Exec Code	2014-03-19	2020-08-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.
19	CVE-2014-1513	787		DoS Exec Code	2014-03-19	2020-08-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.
20	CVE-2014-1512	416		Exec Code	2014-03-19	2020-08-10	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.
21	CVE-2014-1511	269		Bypass	2014-03-19	2020-08-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
22	CVE-2014-1510	269		Exec Code	2014-03-19	2020-08-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.
23	CVE-2014-1509	120		Exec Code Overflow	2014-03-19	2020-08-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
24	CVE-2014-1508	125		DoS Bypass +Info	2014-03-19	2020-08-03	6.4	None	Remote	Low	Not required	Partial	None	Partial
The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.
25	CVE-2014-1505	200		Bypass +Info	2014-03-19	2020-08-05	5.0	None	Remote	Low	Not required	Partial	None	None
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
26	CVE-2014-1504	264		XSS	2014-03-19	2020-08-10	2.6	None	Remote	High	Not required	None	Partial	None
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.
27	CVE-2014-1497	125		DoS +Info	2014-03-19	2020-08-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
28	CVE-2014-1493	119		DoS Exec Code Overflow Mem. Corr.	2014-03-19	2020-08-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
29	CVE-2014-1491	326		Bypass	2014-02-06	2020-07-31	4.3	None	Remote	Medium	Not required	Partial	None	None
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
30	CVE-2014-1490	362		DoS	2014-02-06	2020-07-31	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
31	CVE-2014-1487	346		Bypass +Info	2014-02-06	2020-08-11	5.0	None	Remote	Low	Not required	Partial	None	None
The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
32	CVE-2014-1486	416		Exec Code	2014-02-06	2020-08-07	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.
33	CVE-2014-1485			Exec Code	2014-02-06	2020-08-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
34	CVE-2014-1483	1021		Bypass +Info	2014-02-06	2020-10-23	5.0	None	Remote	Low	Not required	Partial	None	None
Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
35	CVE-2014-1482	787		DoS Exec Code	2014-02-06	2020-08-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.
36	CVE-2014-1481			Bypass	2014-02-06	2020-08-11	5.0	None	Remote	Low	Not required	None	Partial	None
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
37	CVE-2014-1480	1021			2014-02-06	2020-08-21	4.3	None	Remote	Medium	Not required	None	Partial	None
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
38	CVE-2014-1479			Bypass	2014-02-06	2020-08-10	5.0	None	Remote	Low	Not required	None	Partial	None
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
39	CVE-2014-1478	787		DoS Exec Code Mem. Corr.	2014-02-06	2020-08-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.
40	CVE-2014-1477			DoS Exec Code Mem. Corr.	2014-02-06	2020-08-07	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
41	CVE-2014-0553			Exec Code	2014-09-10	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.
42	CVE-2014-0467	119		DoS Overflow	2014-03-14	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.
43	CVE-2014-0128	20		DoS	2014-04-14	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.
44	CVE-2013-6712	119		DoS Overflow	2013-11-28	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.
45	CVE-2013-6425	191		DoS	2014-01-18	2020-10-19	5.0	None	Remote	Low	Not required	None	None	Partial
Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
46	CVE-2013-6420	119		DoS Exec Code Overflow Mem. Corr.	2013-12-17	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
47	CVE-2013-6393	119		DoS Exec Code Overflow	2014-02-06	2018-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.
48	CVE-2013-5211	20		DoS	2014-01-02	2018-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.
49	CVE-2013-5018	119		DoS Overflow	2013-08-28	2018-10-30	4.3	None	Remote	Medium	Not required	None	None	Partial
The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.
50	CVE-2013-4854			DoS	2013-07-29	2019-04-22	7.8	None	Remote	Low	Not required	None	None	Complete
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.

Total number of vulnerabilities : 248 Page : 1 (This Page)2 3 4 5