OP
Product
Openafs
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 8Medium 5Low 0
Watch
Add Openafs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-16947 | 9.8 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 Affected: before 1.6.23; 1.8.0 before 1.8.2 |
| CVE-2024-10397 | 7.8 | Nov 14 | A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code Affected: 1.0 before 1.6.25; 1.8.0 before 1.8.13; 1.9.0 |
| CVE-2024-10394 | 7.8 | Nov 14 | A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number,… Affected: 1.0 before 1.6.25; 1.8.0 before 1.8.13; 1.9.0 |
| CVE-2015-8312 | 7.8 | May 13 | Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input… Affected: through 1.6.15 |
| CVE-2019-18602 | 7.5 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer Affected: before 1.6.24; 1.8.0 before 1.8.5 |
| CVE-2019-18601 | 7.5 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTE_Debug RPC calls to… Affected: before 1.6.24; 1.8.0 before 1.8.5 |
| CVE-2018-16949 | 7.5 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 Affected: before 1.6.23; 1.8.0 before 1.8.2 |
| CVE-2018-16948 | 7.5 | Sep 12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2 Affected: before 1.6.23; 1.8.0 before 1.8.2 |
| CVE-2017-17432 | 7.5 | Dec 6 | OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted… Affected: 1.0 before 1.6.22 |
| CVE-2024-10396 | 6.5 | Nov 14 | An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the fileserver to crash, possibly expose uninitialized memory, and possibly store… Affected: 1.0 before 1.6.25; 1.8.0 before 1.8.13; 1.9.0 |
| CVE-2016-2860 | 6.5 | May 13 | The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and… Affected: through 1.6.16 |
| CVE-2019-18603 | 5.9 | Oct 29 | OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to… Affected: before 1.6.24; 1.8.0 before 1.8.5 |
| CVE-2016-9772 | 5.3 | Feb 6 | OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserver vice partition,… Affected: through 1.6.19 |
| CVE-2016-4536 | 5.3 | May 13 | The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, and (4) ListAddrByAttributes… Affected: through 1.6.16 |
| CVE-2015-7763 | – | Nov 6 | rx/rx.c in OpenAFS 1.5.75 through 1.5.78, 1.6.x before 1.6.15, and 1.7.x before 1.7.33 does not properly initialize padding at the end of an Rx acknowledgement (ACK) packet, which… Affected: 1.5.75; 1.5.76; 1.5.77; 1.5.78; 1.6.0; 1.6.1; +34 more |
| CVE-2015-7762 | – | Nov 6 | rx/rx.c in OpenAFS before 1.6.15 and 1.7.x before 1.7.33 does not properly initialize the padding of a data structure when constructing an Rx acknowledgement (ACK) packet, which… Affected: through 1.6.14.1; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.8; +22 more |
| CVE-2015-6587 | – | Sep 2 | The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a… Affected: through 1.6.12 |
| CVE-2015-3286 | – | Aug 12 | Buffer overflow in the Solaris kernel extension in OpenAFS before 1.6.13 allows local users to cause a denial of service (panic or deadlock) or possibly have other unspecified… Affected: through 1.6.12 |
| CVE-2015-3285 | – | Aug 12 | The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service… Affected: through 1.6.12 |
| CVE-2015-3284 | – | Aug 12 | pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands Affected: through 1.6.12 |
| CVE-2015-3283 | – | Aug 12 | OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors Affected: through 1.6.12 |
| CVE-2015-3282 | – | Aug 12 | vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network Affected: through 1.6.12 |
| CVE-2014-4044 | – | Jun 17 | OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via… Affected: 1.6.8 |
| CVE-2014-2852 | – | Apr 14 | OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid… Affected: through 1.6.6; 1.6.0; 1.6.1; 1.6.2; 1.6.2.1; 1.6.3; +4 more |
| CVE-2014-0159 | – | Apr 14 | Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted… Affected: 1.4.8; 1.4.9; 1.4.10; 1.4.11; 1.4.12; 1.4.14; +12 more |
| CVE-2013-4135 | – | Nov 5 | The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.2.1; 1.6.3; 1.6.4 |
| CVE-2013-4134 | – | Nov 5 | OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service… Affected: through 1.4.14; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2013-1795 | – | Mar 14 | Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a… Affected: through 1.6.1; 1.5.10; 1.5.11; 1.5.12; 1.5.13; 1.5.14; +34 more |
| CVE-2013-1794 | – | Mar 14 | Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via… Affected: through 1.6.1; 1.5.10; 1.5.11; 1.5.12; 1.5.13; 1.5.14; +34 more |
| CVE-2011-0430 | – | Feb 18 | Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute… Affected: 1.4.7; 1.4.12; 1.4.14 |
| CVE-2011-0431 | – | Feb 18 | The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which… Affected: 1.4.7; 1.4.12; 1.4.14 |
| CVE-2009-1251 | – | Apr 9 | Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.4a; +34 more |
| CVE-2009-1250 | – | Apr 9 | The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.4a; +34 more |
| CVE-2007-6599 | – | Jan 4 | Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously… Affected: 1.3.50 through 1.4.5; 1.5.0 through 1.5.27 |
| CVE-2007-1507 | – | Mar 20 | The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.5.0; +15 more |
| CVE-2003-0028 | – | Mar 25 | Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc,… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.4a; +15 more |
Showing 36