FE
Product
Fedora
On CISA KEVExploited in the wildRansomware-linked
5,352
CVEs
87
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 439High 49Medium 11Low 1
Watch
Add Fedora to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-7459 | 9.8 | Feb 15 | Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as… Affected: 24; 25 |
| CVE-2016-2090 | 9.8 | Jan 13 | Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow Affected: 24; 25 |
| CVE-2016-9299 | 9.8 | Jan 12 | The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP… Affected: 25 |
| CVE-2016-8606 | 9.8 | Jan 12 | The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack Affected: 23; 24; 25 |
| CVE-2016-7953 | 9.8 | Dec 13 | Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string Affected: 24; 25 |
| CVE-2016-7951 | 9.8 | Dec 13 | Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks Affected: 24; 25 |
| CVE-2016-7950 | 9.8 | Dec 13 | The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths Affected: 24; 25 |
| CVE-2016-7949 | 9.8 | Dec 13 | Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write… Affected: 24; 25 |
| CVE-2016-7948 | 9.8 | Dec 13 | X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data Affected: 24; 25 |
| CVE-2016-7947 | 9.8 | Dec 13 | Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response Affected: 24; 25 |
| CVE-2016-7944 | 9.8 | Dec 13 | Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to… Affected: 24; 25 |
| CVE-2016-7943 | 9.8 | Dec 13 | The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write… Affected: 25 |
| CVE-2016-7942 | 9.8 | Dec 13 | The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds… Affected: 25 |
| CVE-2016-5407 | 9.8 | Dec 13 | The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors… Affected: 24; 25 |
| CVE-2016-9013 | 9.8 | Dec 9 | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle… Affected: 24; 25 |
| CVE-2016-7167 | 9.8 | Oct 7 | Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have… Affected: 23; 24; 25 |
| CVE-2016-7405 | 9.8 | Oct 3 | The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to… Affected: 25 |
| CVE-2016-4610 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: 30 |
| CVE-2016-4609 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: 30 |
| CVE-2016-4608 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: 30 |
| CVE-2016-4607 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: 30 |
| CVE-2016-3720 | 9.8 | Jun 10 | XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown… Affected: 24 |
| CVE-2016-4544 | 9.8 | May 22 | The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote… Affected: 24 |
| CVE-2016-4543 | 9.8 | May 22 | The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers… Affected: 24 |
| CVE-2016-4542 | 9.8 | May 22 | The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows… Affected: 24 |
| CVE-2016-4541 | 9.8 | May 22 | The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of… Affected: 24 |
| CVE-2016-4540 | 9.8 | May 22 | The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of… Affected: 24 |
| CVE-2016-4539 | 9.8 | May 22 | The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer… Affected: 24 |
| CVE-2016-4538 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are… Affected: 24 |
| CVE-2016-4537 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote… Affected: 24 |
| CVE-2016-4002 | 9.8 | Apr 26 | Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of… Affected: 22; 23; 24 |
| CVE-2016-3074 | 9.8 | Apr 26 | Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via… Affected: 23; 24 |
| CVE-2015-8779 | 9.8 | Apr 19 | Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service… Affected: 23 |
| CVE-2015-8778 | 9.8 | Apr 19 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute… Affected: 23 |
| CVE-2014-9761 | 9.8 | Apr 19 | Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or… Affected: 23 |
| CVE-2016-0729 | 9.8 | Apr 7 | Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote… Affected: 22; 23; 24 |
| CVE-2016-1901 | 9.8 | Jan 20 | Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header,… Affected: 22 |
| CVE-2015-5254 | 9.8 | Jan 8 | Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted… Affected: 22; 23 |
| CVE-2016-1283 | 9.8 | Jan 3 | The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the… Affected: 22; 23 |
| CVE-2015-8391 | 9.8 | Dec 2 | The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or… Affected: 22 |
| CVE-2015-8390 | 9.8 | Dec 2 | PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have… Affected: 22 |
| CVE-2015-8389 | 9.8 | Dec 2 | PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have… Affected: 22 |
| CVE-2015-8386 | 9.8 | Dec 2 | PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer… Affected: 22 |
| CVE-2015-8383 | 9.8 | Dec 2 | PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other… Affected: 22 |
| CVE-2014-1532 | 9.8 | Apr 30 | Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird… Affected: 19; 20 |
| CVE-2014-1524 | 9.8 | Apr 30 | The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not… Affected: 19; 20 |
| CVE-2014-1486 | 9.8 | Feb 6 | Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24… Affected: 19; 20 |
| CVE-2014-1477 | 9.8 | Feb 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow… Affected: 19; 20 |
| CVE-2013-6671 | 9.8 | Dec 11 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers… Affected: 18; 19; 20 |
| CVE-2013-5618 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x… Affected: 18; 19; 20 |
The 500 most important CVEs for this product (exploited first, then by severity)