OP
Product
Opensuse
On CISA KEVExploited in the wildRansomware-linked
1,456
CVEs
45
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 86High 271Medium 142Low 1
Watch
Add Opensuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-1822 | 8.8 | Oct 4 | WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and Google Chrome before 6.0.472.62, does not properly perform a cast of an unspecified variable, which allows… Affected: 11.2; 11.3 |
| CVE-2010-1773 | 8.8 | Sep 24 | Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70, allows remote… Affected: 11.2; 11.3 |
| CVE-2010-1772 | 8.8 | Sep 24 | Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859, as used in Google Chrome before 5.0.375.70, allows remote attackers to execute arbitrary… Affected: 11.2; 11.3 |
| CVE-2010-2753 | 8.8 | Jul 30 | Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote… Affected: 11.1; 11.2; 11.3 |
| CVE-2010-0050 | 8.8 | Mar 15 | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML… Affected: 11.2; 11.3 |
| CVE-2010-0012 | 8.8 | Jan 8 | Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a Affected: 11.0; 11.1; 11.2 |
| CVE-2016-1286 | 8.6 | Mar 9 | named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature… Affected: 11.4; 13.1; 13.2 |
| CVE-2016-3100 | 8.4 | Jul 13 | kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture… Affected: 13.2 |
| CVE-2016-1572 | 8.4 | Jan 22 | mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard… Affected: 13.1; 13.2 |
| CVE-2016-5421 | 8.1 | Aug 10 | Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors Affected: 13.2 |
| CVE-2016-5387 | 8.1 | Jul 19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY… Affected: 13.2 |
| CVE-2015-7547 | 8.1 | Feb 18 | Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote… Affected: 13.2 |
| CVE-2016-1661 | 8.0 | May 14 | Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which… Affected: 13.1 |
| CVE-2015-2325 | 7.8 | Jan 14 | The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or… Affected: 13.1; 13.2 |
| CVE-2012-2142 | 7.8 | Jan 9 | The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator Affected: 12.2 |
| CVE-2011-1588 | 7.8 | Nov 14 | Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error Affected: 11.4 |
| CVE-2011-1145 | 7.8 | Nov 14 | The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string Affected: 11.3; 11.4 |
| CVE-2010-4661 | 7.8 | Nov 13 | udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules Affected: 11.3; 11.4 |
| CVE-2017-5333 | 7.8 | Nov 4 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process… Affected: 13.2 |
| CVE-2017-5332 | 7.8 | Nov 4 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service… Affected: 13.2 |
| CVE-2017-5331 | 7.8 | Nov 4 | Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute… Affected: 13.2 |
| CVE-2014-5220 | 7.8 | Jun 8 | The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary… Affected: 13.2 |
| CVE-2016-2347 | 7.8 | Apr 21 | Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive Affected: 13.2 |
| CVE-2016-9959 | 7.8 | Apr 12 | game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values Affected: 12.1 |
| CVE-2016-9958 | 7.8 | Apr 12 | game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations Affected: 12.1 |
| CVE-2016-9957 | 7.8 | Apr 12 | Stack-based buffer overflow in game-music-emu before 0.6.1 Affected: 12.1 |
| CVE-2014-9114 | 7.8 | Mar 31 | Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code Affected: 13.1; 13.2 |
| CVE-2016-8693 | 7.8 | Feb 15 | Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute… Affected: 13.2 |
| CVE-2016-8684 | 7.8 | Feb 15 | The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation… Affected: 13.2 |
| CVE-2016-8683 | 7.8 | Feb 15 | The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation… Affected: 13.2 |
| CVE-2016-9453 | 7.8 | Jan 27 | The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a… Affected: 13.2 |
| CVE-2015-5228 | 7.8 | Jun 7 | The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors… Affected: 13.2 |
| CVE-2016-3697 | 7.8 | Jun 1 | libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain… Affected: 13.2 |
| CVE-2015-7552 | 7.8 | Apr 18 | Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute… Affected: 13.2 |
| CVE-2015-3629 | 7.8 | May 18 | Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a… Affected: 13.2 |
| CVE-2012-1185 | 7.8 | Jun 5 | Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory… Affected: 11.4; 12.1 |
| CVE-2010-4040 | 7.8 | Oct 21 | Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have… Affected: 11.2 through 11.3 |
| CVE-2010-2798 | 7.8 | Sep 8 | The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries,… Affected: 11.1 |
| CVE-2009-3620 | 7.8 | Oct 22 | The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users… Affected: 11.0 |
| CVE-2009-3289 | 7.8 | Sep 22 | The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of… Affected: 11.0; 11.1 |
| CVE-2009-0115 | 7.8 | Mar 30 | The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly… Affected: 10.3 through 11.0 |
| CVE-2009-0749 | 7.8 | Mar 2 | Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial… Affected: 10.3 through 11.1 |
| CVE-2008-2931 | 7.8 | Jul 9 | The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain… Affected: 10.3 through 11.0 |
| CVE-2008-2812 | 7.8 | Jul 9 | The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via… Affected: 10.3; 11.0 |
| CVE-2015-8567 | 7.7 | Apr 13 | Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption) Affected: 13.2 |
| CVE-2015-5333 | 7.5 | Jan 23 | Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object… Affected: 13.2 |
| CVE-2014-8179 | 7.5 | Dec 17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which… Affected: 13.2 |
| CVE-2014-3495 | 7.5 | Dec 13 | duplicity 0.6.24 has improper verification of SSL certificates Affected: 12.3; 13.1 |
| CVE-2016-1254 | 7.5 | Dec 5 | Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor Affected: 13.2 |
| CVE-2014-3462 | 7.5 | Aug 7 | The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes" Affected: 13.2 |
The 500 most important CVEs for this product (exploited first, then by severity)