FE
Product
Fedora
On CISA KEVExploited in the wildRansomware-linked
5,352
CVEs
87
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 439High 49Medium 11Low 1
Watch
Add Fedora to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-5616 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and… Affected: 18; 19; 20 |
| CVE-2013-5615 | 9.8 | Dec 11 | The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain… Affected: 18; 19; 20 |
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 18; 19; 20 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 18; 19; 20 |
| CVE-2012-4406 | 9.8 | Oct 22 | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote… Affected: 16 |
| CVE-2010-4197 | 9.8 | Nov 6 | Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of… Affected: 13 |
| CVE-2010-4204 | 9.8 | Nov 5 | WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote… Affected: 13 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: 12; 13; 14 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 12; 13 |
| CVE-2009-3555 | 9.8 | Nov 9 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and… Affected: 11; 12; 13; 14 |
| CVE-2008-2374 | 9.8 | Jul 7 | src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows… Affected: 8; 9 |
| CVE-2008-2108 | 9.8 | May 7 | The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during… Affected: 8; 9 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: 8; 9 |
| CVE-2008-0062 | 9.8 | Mar 19 | KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute… Affected: 7; 8 |
| CVE-2007-6013 | 9.8 | Nov 19 | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the… Affected: 7; 8 |
| CVE-2024-4558 | 9.6 | May 7 | Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: 38; 39; 40 |
| CVE-2024-3157 | 9.6 | Apr 10 | Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox… Affected: 38; 39; 40 |
| CVE-2022-0097 | 9.6 | Feb 12 | Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to to potentially allow… Affected: 34; 35; 36 |
| CVE-2021-38013 | 9.6 | Dec 23 | Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to… Affected: 34 |
| CVE-2021-38002 | 9.6 | Nov 23 | Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 34 |
| CVE-2021-30571 | 9.6 | Aug 3 | Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 33; 34; 35 |
| CVE-2021-21226 | 9.6 | Apr 26 | Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via… Affected: 32; 33; 34 |
| CVE-2021-21223 | 9.6 | Apr 26 | Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 32; 33; 34 |
| CVE-2021-21201 | 9.6 | Apr 26 | Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via… Affected: 32; 33; 34 |
| CVE-2021-21155 | 9.6 | Feb 22 | Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a… Affected: 32; 33 |
| CVE-2021-21154 | 9.6 | Feb 22 | Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 32; 33 |
| CVE-2021-21151 | 9.6 | Feb 22 | Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 32; 33 |
| CVE-2021-21150 | 9.6 | Feb 22 | Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 32; 33 |
| CVE-2021-21146 | 9.6 | Feb 9 | Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via… Affected: 32; 33 |
| CVE-2021-21142 | 9.6 | Feb 9 | Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 32; 33 |
| CVE-2021-21115 | 9.6 | Jan 8 | User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… Affected: 32; 33 |
| CVE-2021-21111 | 9.6 | Jan 8 | Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a… Affected: 32; 33 |
| CVE-2021-21110 | 9.6 | Jan 8 | Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 32; 33 |
| CVE-2021-21109 | 9.6 | Jan 8 | Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 32; 33 |
| CVE-2021-21108 | 9.6 | Jan 8 | Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 32; 33 |
| CVE-2021-21107 | 9.6 | Jan 8 | Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a… Affected: 32; 33 |
| CVE-2021-21106 | 9.6 | Jan 8 | Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 32; 33 |
| CVE-2020-6573 | 9.6 | Sep 21 | Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 31; 33 |
| CVE-2020-15963 | 9.6 | Sep 21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 31; 32; 33 |
| CVE-2020-15961 | 9.6 | Sep 21 | Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 31; 32; 33 |
| CVE-2020-6522 | 9.6 | Jul 22 | Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted… Affected: 31; 32 |
| CVE-2020-15121 | 9.6 | Jul 20 | In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection Affected: 31; 32 |
| CVE-2020-6471 | 9.6 | May 21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 31; 32 |
| CVE-2020-6469 | 9.6 | May 21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially… Affected: 31; 32 |
| CVE-2020-6466 | 9.6 | May 21 | Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a… Affected: 31; 32 |
| CVE-2020-6465 | 9.6 | May 21 | Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 31; 32 |
| CVE-2019-5759 | 9.6 | Feb 19 | Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via… Affected: 29; 30 |
| CVE-2024-1874 | 9.4 | Apr 29 | In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of… Affected: 39; 40 |
| CVE-2021-32642 | 9.4 | May 28 | radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports Affected: 33; 34 |
| CVE-2022-2010 | 9.3 | Jul 28 | Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 37 |
The 500 most important CVEs for this product (exploited first, then by severity)