OP
Product
Opensuse
On CISA KEVExploited in the wildRansomware-linked
1,456
CVEs
45
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 86High 271Medium 142Low 1
Watch
Add Opensuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3992 | 6.2 | Jul 26 | cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp Affected: 13.2 |
| CVE-2016-4804 | 6.2 | Jun 3 | The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer… Affected: 13.2 |
| CVE-2015-8872 | 6.2 | Jun 3 | The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing… Affected: 13.2 |
| CVE-2016-3186 | 6.2 | Apr 19 | Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file Affected: 13.2 |
| CVE-2015-5969 | 6.2 | Apr 8 | The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package… Affected: 13.2 |
| CVE-2013-2637 | 6.1 | Feb 12 | A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles,… Affected: 12.2; 12.3 |
| CVE-2013-3565 | 6.1 | Jan 31 | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML… Affected: 13.1 |
| CVE-2013-7370 | 6.1 | Dec 11 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware Affected: 13.1 |
| CVE-2016-4068 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: 13.1; 13.2 |
| CVE-2015-8864 | 6.1 | Apr 13 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG,… Affected: 13.1; 13.2 |
| CVE-2016-5099 | 6.1 | Jul 5 | Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special… Affected: 13.1 |
| CVE-2016-5733 | 6.1 | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary… Affected: 13.1; 13.2 |
| CVE-2016-5731 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to… Affected: 13.1; 13.2 |
| CVE-2016-5705 | 6.1 | Jul 3 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via… Affected: 13.1; 13.2 |
| CVE-2016-5701 | 6.1 | Jul 3 | setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks… Affected: 13.1; 13.2 |
| CVE-2016-2833 | 6.1 | Jun 13 | Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site… Affected: 13.1; 13.2 |
| CVE-2016-1682 | 6.1 | Jun 5 | The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before… Affected: 13.2 |
| CVE-2016-1937 | 6.1 | Jan 31 | The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a… Affected: 13.1; 13.2 |
| CVE-2014-1530 | 6.1 | Apr 30 | The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the… Affected: 11.4; 12.3; 13.1 |
| CVE-2015-8551 | 6.0 | Apr 13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and… Affected: 13.1 |
| CVE-2014-4616 | 5.9 | Aug 24 | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process… Affected: 13.1 |
| CVE-2016-4955 | 5.9 | Jul 5 | ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a… Affected: 13.2 |
| CVE-2016-4429 | 5.9 | Jun 10 | Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash)… Affected: 13.2 |
| CVE-2016-4008 | 5.9 | May 5 | The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a… Affected: 13.2 |
| CVE-2016-2107 | 5.9 | May 5 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to… Affected: 13.2 |
| CVE-2016-0787 | 5.9 | Apr 13 | The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to… Affected: 13.2 |
| CVE-2015-2774 | 5.9 | Apr 7 | Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data… Affected: 13.2 |
| CVE-2015-7744 | 5.9 | Jan 22 | wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low… Affected: 13.1; 13.2 |
| CVE-2015-7575 | 5.9 | Jan 9 | Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key… Affected: 13.1; 13.2 |
| CVE-2013-6673 | 5.9 | Dec 11 | Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509… Affected: 12.2; 12.3; 13.1 |
| CVE-2009-2408 | 5.9 | Jul 30 | Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a… Affected: 10.3 through 11.1 |
| CVE-2008-4989 | 5.9 | Nov 13 | The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary… Affected: 10.3 through 11.1 |
| CVE-2015-2326 | 5.5 | Jan 14 | The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular… Affected: 13.1; 13.2 |
| CVE-2014-8178 | 5.5 | Dec 17 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the… Affected: 13.2 |
| CVE-2011-1490 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages… Affected: 11.4 |
| CVE-2011-1489 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages… Affected: 11.4 |
| CVE-2011-1488 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled Affected: 11.4 |
| CVE-2013-3718 | 5.5 | Nov 1 | evince is missing a check on number of pages which can lead to a segmentation fault Affected: 13.1 |
| CVE-2015-5203 | 5.5 | Aug 2 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file Affected: 13.1; 13.2 |
| CVE-2015-5221 | 5.5 | Jul 25 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial… Affected: 13.1; 13.2 |
| CVE-2014-9845 | 5.5 | Mar 20 | The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file Affected: 13.2 |
| CVE-2014-9844 | 5.5 | Mar 20 | The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file Affected: 13.2 |
| CVE-2014-9853 | 5.5 | Mar 17 | Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file Affected: 13.2 |
| CVE-2016-9830 | 5.5 | Mar 1 | The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image Affected: 13.2 |
| CVE-2016-8569 | 5.5 | Feb 3 | The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a… Affected: 13.2 |
| CVE-2016-8568 | 5.5 | Feb 3 | The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted… Affected: 13.2 |
| CVE-2016-5241 | 5.5 | Feb 3 | magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file Affected: 13.2 |
| CVE-2016-2318 | 5.5 | Feb 3 | GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in… Affected: 13.2 |
| CVE-2016-2317 | 5.5 | Feb 3 | Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in… Affected: 13.2 |
| CVE-2016-6265 | 5.5 | Sep 22 | Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file Affected: 13.2 |
The 500 most important CVEs for this product (exploited first, then by severity)